* [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area
@ 2019-05-20 9:13 Kefeng Wang
2019-05-20 9:13 ` [PATCH 2/2] hwtracing: stm: fix double-free in stm_source_register_device() Kefeng Wang
2019-05-20 9:19 ` [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area Kefeng Wang
0 siblings, 2 replies; 4+ messages in thread
From: Kefeng Wang @ 2019-05-20 9:13 UTC (permalink / raw)
To: Alexander Shishkin, Greg Kroah-Hartman, Maxime Coquelin,
Alexandre Torgue, linux-stm32, linux-kernel
Cc: Kefeng Wang, Hulk Robot
If device_add() in stm_register_device() fails, stm_device_release()
is called to free stm, free stm again on err_device path will trigger
following warning,
Trying to vfree() nonexistent vm area (0000000054b5e7bc)
WARNING: CPU: 0 PID: 6004 at mm/vmalloc.c:1595 __vunmap+0x72/0x480 mm/vmalloc.c:1594
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 6004 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
__vfree+0x2a/0x80 mm/vmalloc.c:1658
_vfree+0x49/0x70 mm/vmalloc.c:1688
stm_register_device+0x295/0x330 [stm_core]
dummy_stm_init+0xfe/0x1e0 [dummy_stm]
do_one_initcall+0xb9/0x3b5 init/main.c:914
do_init_module+0xe0/0x330 kernel/module.c:3468
load_module+0x38eb/0x4270 kernel/module.c:3819
__do_sys_finit_module+0x162/0x190 kernel/module.c:3909
do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Only free stm once if device_add() fails to fix it.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
drivers/hwtracing/stm/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index e55b902560de..7b2ab7b2cc4d 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -864,6 +864,7 @@ static void stm_device_release(struct device *dev)
struct stm_device *stm = to_stm_device(dev);
vfree(stm);
+ stm->data->stm = NULL;
}
int stm_register_device(struct device *parent, struct stm_data *stm_data,
@@ -933,7 +934,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
/* matches device_initialize() above */
put_device(&stm->dev);
err_free:
- vfree(stm);
+ if (stm->data->stm)
+ vfree(stm);
return err;
}
--
2.20.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 2/2] hwtracing: stm: fix double-free in stm_source_register_device()
2019-05-20 9:13 [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area Kefeng Wang
@ 2019-05-20 9:13 ` Kefeng Wang
2019-05-20 9:20 ` Kefeng Wang
2019-05-20 9:19 ` [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area Kefeng Wang
1 sibling, 1 reply; 4+ messages in thread
From: Kefeng Wang @ 2019-05-20 9:13 UTC (permalink / raw)
To: Alexander Shishkin, Greg Kroah-Hartman, Maxime Coquelin,
Alexandre Torgue, linux-stm32, linux-kernel
Cc: Kefeng Wang, Hulk Robot
If device_add() in stm_source_register_device() fails,
stm_source_device_release() is called to free src, free
src again on err path will trigger double free issue.
BUG: KASAN: double-free or invalid-free in stm_source_register_device+0xd0/0x1a0 [stm_core]
CPU: 1 PID: 8556 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xa9/0x10e lib/dump_stack.c:113
print_address_description+0x65/0x270 mm/kasan/report.c:188
kasan_report_invalid_free+0x60/0xa0 mm/kasan/report.c:279
__kasan_slab_free+0x159/0x180 mm/kasan/common.c:430
slab_free_hook mm/slub.c:1420 [inline]
slab_free_freelist_hook mm/slub.c:1447 [inline]
slab_free mm/slub.c:2994 [inline]
kfree+0xe1/0x270 mm/slub.c:3949
stm_source_register_device+0xd0/0x1a0 [stm_core]
stm_heartbeat_init+0xb6/0x1b0 [stm_heartbeat]
do_one_initcall+0xb9/0x3b5 init/main.c:914
do_init_module+0xe0/0x330 kernel/module.c:3468
load_module+0x38eb/0x4270 kernel/module.c:3819
__do_sys_finit_module+0x162/0x190 kernel/module.c:3909
do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
...
Allocated by task 8556:
save_stack+0x19/0x80 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_kmalloc.constprop.2+0xa0/0xd0 mm/kasan/common.c:489
stm_source_register_device+0x46/0x1a0 [stm_core]
stm_heartbeat_init+0xb6/0x1b0 [stm_heartbeat]
do_one_initcall+0xb9/0x3b5 init/main.c:914
do_init_module+0xe0/0x330 kernel/module.c:3468
load_module+0x38eb/0x4270 kernel/module.c:3819
__do_sys_finit_module+0x162/0x190 kernel/module.c:3909
do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8556:
save_stack+0x19/0x80 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:451
slab_free_hook mm/slub.c:1420 [inline]
slab_free_freelist_hook mm/slub.c:1447 [inline]
slab_free mm/slub.c:2994 [inline]
kfree+0xe1/0x270 mm/slub.c:3949
device_release+0x46/0x100 drivers/base/core.c:1064
kobject_cleanup lib/kobject.c:691 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:67 [inline]
kobject_put+0x1a8/0x220 lib/kobject.c:737
put_device+0x1b/0x30 drivers/base/core.c:2210
stm_source_register_device+0xc8/0x1a0 [stm_core]
stm_heartbeat_init+0xb6/0x1b0 [stm_heartbeat]
do_one_initcall+0xb9/0x3b5 init/main.c:914
do_init_module+0xe0/0x330 kernel/module.c:3468
load_module+0x38eb/0x4270 kernel/module.c:3819
__do_sys_finit_module+0x162/0x190 kernel/module.c:3909
do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Don't call kfree(src) if device_add() fails to fix it.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
drivers/hwtracing/stm/core.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 7b2ab7b2cc4d..5ce30f8f8c4f 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1258,15 +1258,20 @@ int stm_source_register_device(struct device *parent,
src->dev.release = stm_source_device_release;
err = kobject_set_name(&src->dev.kobj, "%s", data->name);
- if (err)
+ if (err) {
+ put_device(&src->dev);
+ kfree(src);
goto err;
+ }
pm_runtime_no_callbacks(&src->dev);
pm_runtime_forbid(&src->dev);
err = device_add(&src->dev);
- if (err)
- goto err;
+ if (err) {
+ put_device(&src->dev);
+ return err;
+ }
stm_output_init(&src->output);
spin_lock_init(&src->link_lock);
@@ -1275,12 +1280,6 @@ int stm_source_register_device(struct device *parent,
data->src = src;
return 0;
-
-err:
- put_device(&src->dev);
- kfree(src);
-
- return err;
}
EXPORT_SYMBOL_GPL(stm_source_register_device);
--
2.20.1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH 2/2] hwtracing: stm: fix double-free in stm_source_register_device()
2019-05-20 9:13 ` [PATCH 2/2] hwtracing: stm: fix double-free in stm_source_register_device() Kefeng Wang
@ 2019-05-20 9:20 ` Kefeng Wang
0 siblings, 0 replies; 4+ messages in thread
From: Kefeng Wang @ 2019-05-20 9:20 UTC (permalink / raw)
To: Alexander Shishkin, Greg Kroah-Hartman, Maxime Coquelin,
Alexandre Torgue, linux-stm32, linux-kernel
Cc: Hulk Robot
sorry, send wrong version, please ignore.
On 2019/5/20 17:13, Kefeng Wang wrote:
> If device_add() in stm_source_register_device() fails,
> stm_source_device_release() is called to free src, free
> src again on err path will trigger double free issue.
>
> BUG: KASAN: double-free or invalid-free in stm_source_register_device+0xd0/0x1a0 [stm_core]
>
> CPU: 1 PID: 8556 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xa9/0x10e lib/dump_stack.c:113
> print_address_description+0x65/0x270 mm/kasan/report.c:188
> kasan_report_invalid_free+0x60/0xa0 mm/kasan/report.c:279
> __kasan_slab_free+0x159/0x180 mm/kasan/common.c:430
> slab_free_hook mm/slub.c:1420 [inline]
> slab_free_freelist_hook mm/slub.c:1447 [inline]
> slab_free mm/slub.c:2994 [inline]
> kfree+0xe1/0x270 mm/slub.c:3949
> stm_source_register_device+0xd0/0x1a0 [stm_core]
> stm_heartbeat_init+0xb6/0x1b0 [stm_heartbeat]
> do_one_initcall+0xb9/0x3b5 init/main.c:914
> do_init_module+0xe0/0x330 kernel/module.c:3468
> load_module+0x38eb/0x4270 kernel/module.c:3819
> __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
> do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> ...
>
> Allocated by task 8556:
> save_stack+0x19/0x80 mm/kasan/common.c:71
> set_track mm/kasan/common.c:79 [inline]
> __kasan_kmalloc.constprop.2+0xa0/0xd0 mm/kasan/common.c:489
> stm_source_register_device+0x46/0x1a0 [stm_core]
> stm_heartbeat_init+0xb6/0x1b0 [stm_heartbeat]
> do_one_initcall+0xb9/0x3b5 init/main.c:914
> do_init_module+0xe0/0x330 kernel/module.c:3468
> load_module+0x38eb/0x4270 kernel/module.c:3819
> __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
> do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Freed by task 8556:
> save_stack+0x19/0x80 mm/kasan/common.c:71
> set_track mm/kasan/common.c:79 [inline]
> __kasan_slab_free+0x130/0x180 mm/kasan/common.c:451
> slab_free_hook mm/slub.c:1420 [inline]
> slab_free_freelist_hook mm/slub.c:1447 [inline]
> slab_free mm/slub.c:2994 [inline]
> kfree+0xe1/0x270 mm/slub.c:3949
> device_release+0x46/0x100 drivers/base/core.c:1064
> kobject_cleanup lib/kobject.c:691 [inline]
> kobject_release lib/kobject.c:720 [inline]
> kref_put include/linux/kref.h:67 [inline]
> kobject_put+0x1a8/0x220 lib/kobject.c:737
> put_device+0x1b/0x30 drivers/base/core.c:2210
> stm_source_register_device+0xc8/0x1a0 [stm_core]
> stm_heartbeat_init+0xb6/0x1b0 [stm_heartbeat]
> do_one_initcall+0xb9/0x3b5 init/main.c:914
> do_init_module+0xe0/0x330 kernel/module.c:3468
> load_module+0x38eb/0x4270 kernel/module.c:3819
> __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
> do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Don't call kfree(src) if device_add() fails to fix it.
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
> drivers/hwtracing/stm/core.c | 17 ++++++++---------
> 1 file changed, 8 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> index 7b2ab7b2cc4d..5ce30f8f8c4f 100644
> --- a/drivers/hwtracing/stm/core.c
> +++ b/drivers/hwtracing/stm/core.c
> @@ -1258,15 +1258,20 @@ int stm_source_register_device(struct device *parent,
> src->dev.release = stm_source_device_release;
>
> err = kobject_set_name(&src->dev.kobj, "%s", data->name);
> - if (err)
> + if (err) {
> + put_device(&src->dev);
> + kfree(src);
> goto err;
> + }
>
> pm_runtime_no_callbacks(&src->dev);
> pm_runtime_forbid(&src->dev);
>
> err = device_add(&src->dev);
> - if (err)
> - goto err;
> + if (err) {
> + put_device(&src->dev);
> + return err;
> + }
>
> stm_output_init(&src->output);
> spin_lock_init(&src->link_lock);
> @@ -1275,12 +1280,6 @@ int stm_source_register_device(struct device *parent,
> data->src = src;
>
> return 0;
> -
> -err:
> - put_device(&src->dev);
> - kfree(src);
> -
> - return err;
> }
> EXPORT_SYMBOL_GPL(stm_source_register_device);
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area
2019-05-20 9:13 [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area Kefeng Wang
2019-05-20 9:13 ` [PATCH 2/2] hwtracing: stm: fix double-free in stm_source_register_device() Kefeng Wang
@ 2019-05-20 9:19 ` Kefeng Wang
1 sibling, 0 replies; 4+ messages in thread
From: Kefeng Wang @ 2019-05-20 9:19 UTC (permalink / raw)
To: Alexander Shishkin, Greg Kroah-Hartman, Maxime Coquelin,
Alexandre Torgue, linux-stm32, linux-kernel
Cc: Hulk Robot
sorry, send wrong version, please ignore.
On 2019/5/20 17:13, Kefeng Wang wrote:
> If device_add() in stm_register_device() fails, stm_device_release()
> is called to free stm, free stm again on err_device path will trigger
> following warning,
>
> Trying to vfree() nonexistent vm area (0000000054b5e7bc)
> WARNING: CPU: 0 PID: 6004 at mm/vmalloc.c:1595 __vunmap+0x72/0x480 mm/vmalloc.c:1594
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 0 PID: 6004 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> Call Trace:
> __vfree+0x2a/0x80 mm/vmalloc.c:1658
> _vfree+0x49/0x70 mm/vmalloc.c:1688
> stm_register_device+0x295/0x330 [stm_core]
> dummy_stm_init+0xfe/0x1e0 [dummy_stm]
> do_one_initcall+0xb9/0x3b5 init/main.c:914
> do_init_module+0xe0/0x330 kernel/module.c:3468
> load_module+0x38eb/0x4270 kernel/module.c:3819
> __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
> do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Only free stm once if device_add() fails to fix it.
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
> drivers/hwtracing/stm/core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> index e55b902560de..7b2ab7b2cc4d 100644
> --- a/drivers/hwtracing/stm/core.c
> +++ b/drivers/hwtracing/stm/core.c
> @@ -864,6 +864,7 @@ static void stm_device_release(struct device *dev)
> struct stm_device *stm = to_stm_device(dev);
>
> vfree(stm);
> + stm->data->stm = NULL;
> }
>
> int stm_register_device(struct device *parent, struct stm_data *stm_data,
> @@ -933,7 +934,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
> /* matches device_initialize() above */
> put_device(&stm->dev);
> err_free:
> - vfree(stm);
> + if (stm->data->stm)
> + vfree(stm);
>
> return err;
> }
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-05-20 9:22 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-20 9:13 [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area Kefeng Wang
2019-05-20 9:13 ` [PATCH 2/2] hwtracing: stm: fix double-free in stm_source_register_device() Kefeng Wang
2019-05-20 9:20 ` Kefeng Wang
2019-05-20 9:19 ` [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area Kefeng Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome