lkml.org 
[lkml]   [2021]   [Oct]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 44/75] cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
    Date
    From: James Morse <james.morse@arm.com>

    [ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ]

    Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release()
    method to free sugov_tunables") kobject_put() has kfree()d the
    attr_set before gov_attr_set_put() returns.

    kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
    the subsequent mutex_destroy() triggers a use-after-free:
    | BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
    | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
    |
    | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
    | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
    | Platform, BIOS EDK II Jul 30 2018
    | Call trace:
    | dump_backtrace+0x0/0x380
    | show_stack+0x1c/0x30
    | dump_stack_lvl+0x8c/0xb8
    | print_address_description.constprop.0+0x74/0x2b8
    | kasan_report+0x1f4/0x210
    | kasan_check_range+0xfc/0x1a4
    | __kasan_check_read+0x38/0x60
    | mutex_is_locked+0x20/0x60
    | mutex_destroy+0x80/0x100
    | gov_attr_set_put+0xfc/0x150
    | sugov_exit+0x78/0x190
    | cpufreq_offline.isra.0+0x2c0/0x660
    | cpuhp_cpufreq_offline+0x14/0x24
    | cpuhp_invoke_callback+0x430/0x6d0
    | cpuhp_thread_fun+0x1b0/0x624
    | smpboot_thread_fn+0x5e0/0xa6c
    | kthread+0x3a0/0x450
    | ret_from_fork+0x10/0x20

    Swap the order of the calls.

    Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
    Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
    Signed-off-by: James Morse <james.morse@arm.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
    index 52841f807a7e..45fdf30cade3 100644
    --- a/drivers/cpufreq/cpufreq_governor_attr_set.c
    +++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
    @@ -77,8 +77,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
    if (count)
    return count;

    - kobject_put(&attr_set->kobj);
    mutex_destroy(&attr_set->update_lock);
    + kobject_put(&attr_set->kobj);
    return 0;
    }
    EXPORT_SYMBOL_GPL(gov_attr_set_put);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-10-04 15:03    [W:3.001 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site