ACPI: CPPC: per-CPU cpc_desc is freed on processor unbind without clearing the published pointer, causing UAF in cpufreq accessors

[徐晗翔 <xuhx@hust.edu.cn>]

[-- Attachment #1: Type: text/plain, Size: 7640 bytes --]

acpi_processor_stop() can be reached through the processor driver's
sysfs unbind attribute while the target CPU is still online.  It calls
acpi_cppc_processor_exit(), which iounmap()s the _CPC system-memory
registers and kfree()s the per-CPU struct cpc_desc, but never clears
per_cpu(cpc_desc_ptr, pr->id).  The cpufreq accessors (and the
acpi_cppc sysfs attributes) read that per-CPU pointer without a common
lock, refcount, or RCU grace period, so after the unbind they can
continue to use the freed descriptor.  A KASAN kernel reproduced the
slab-use-after-free with a real "echo cpu0 > .../processor/unbind",
not with a synthetic direct call to the exit function.

The detailed description:

* Test environment / affected version

  Linux 7.3.0 (mainline 7.3 source, unmodified), KASAN build from
  verification/build-kasan-7.3, x86_64 QEMU/KVM guest, 2 vCPU,
  CONFIG_KASAN=y, CONFIG_BUG=y, CONFIG_HOTPLUG_SMT=y.  The guest used a
  test SSDT (cpcint.aml) that adds a 21-entry, all-integer _CPC package
  to \_SB.CPUS.C000/C001, so the normal acpi_cppc_processor_probe()
  created a real cpc_desc and a real acpi_cppc sysfs directory.

  The test kernel has CONFIG_ACPI_CPPC_LIB=y and
  CONFIG_ACPI_PROCESSOR=y, but CONFIG_ACPI_CPPC_CPUFREQ is not enabled.
  The concurrent accessor in the reproducer is therefore a module
  calling the exported cppc_get_perf_caps(0), not a real
  cppc_cpufreq tick.  The release side is the real driver-core
  unbind path; the accessor function and the released object are the
  same as in the cpufreq/sysfs paths described below.  Line numbers
  are from Linux 7.3.

* Mechanism

  The ACPI processor driver is bound to the cpu_subsys CPU device and
  has .remove = acpi_processor_stop (drivers/acpi/processor_driver.c:
  45-50).  Writing a CPU name to
  /sys/bus/cpu/drivers/processor/unbind runs
  unbind_store() -> device_release_driver() -> acpi_processor_stop()
  (drivers/base/bus.c:235-251, drivers/base/dd.c:1318-1375).
  __device_release_driver() takes only the CPU device's device_lock;
  it does not take a CPU-hotplug lock and does not require the CPU to
  be offline.  acpi_processor_stop() has no online check either and
  calls acpi_cppc_processor_exit(pr) at processor_driver.c:204.

  acpi_cppc_processor_exit() (drivers/acpi/cppc_acpi.c:1037-1068)
  performs, in this order:

    pcc_data refcount/free
      -> iounmap(cpc_ptr->cpc_regs[i].sys_mem_vaddr)
      -> kobject_put(&cpc_ptr->kobj)
      -> kfree(cpc_ptr)

  There is no corresponding
  per_cpu(cpc_desc_ptr, pr->id) = NULL.  The pointer was published by
  acpi_cppc_processor_probe() at cppc_acpi.c:1002.  cppc_ktype has no
  .release callback (cppc_acpi.c:300-303), so kobject_put() only
  removes the sysfs directory and drains its active references; it is
  not a lifetime barrier for the descriptor.

  The accessors take the pointer outside any lock:

    cppc_get_reg_val():    cpc_desc = per_cpu(cpc_desc_ptr, cpu);
                           if (!cpc_desc) return -ENODEV;
                           reg = &cpc_desc->cpc_regs[reg_idx];
    cppc_get_perf_caps():  same pattern (cppc_acpi.c:1488 onwards)
    cppc_get_perf_ctrs():  same pattern (cppc_acpi.c:1678 onwards)

  The NULL check does not help: after exit the per-CPU slot is still
  non-NULL and points to freed memory.

  The cpufreq policy is owned by the cpufreq core, not by the ACPI
  processor driver.  acpi_processor_stop() neither offlines the CPU nor
  tears down the policy, so a registered CPPC frequency-invariance
  source can keep calling cppc_get_perf_ctrs() after unbind
  (drivers/cpufreq/cppc_cpufreq.c:69-104, 150-184).  The
  cpuinfo_cur_freq sysfs attribute reaches the driver's .get callback
  through __cpufreq_get() (drivers/cpufreq/cpufreq.c:755-764), and the
  acpi_cppc attributes call cppc_get_perf_caps() from show_cppc_data()
  (cppc_acpi.c:160-186).

  There is also a mapping-lifetime sub-case.  For _CPC registers in
  ACPI_ADR_SPACE_SYSTEM_MEMORY, cpc_read()/cpc_write() use
  reg_res->sys_mem_vaddr directly (cppc_acpi.c:1162-1180 and
  1235-1250), while exit iounmap()s those addresses before
  kobject_put().  A sysfs show that is still running can therefore
  reach readb/readw/readl/readq_relaxed() after the mapping was
  revoked; an EPP store can do the same through cpc_write().  The
  kernfs drain inside kobject_put() protects the later kfree(cpc_ptr),
  but it starts only after iounmap(), so it does not protect the
  mapping.  This sub-case is source-level only in this report; the
  tested guest had an all-integer _CPC and did not establish a
  system-memory _CPC successfully.

  A separate SMT path is worth fixing even though it was not the
  reproduced one: cpuhp_smt_enable() calls _cpu_up(cpu, 0,
  CPUHP_ONLINE) without taking the CPU device's device_lock
  (kernel/cpu.c:2702-2725, called from the smt/control store at
  2920-2940), while unbind_store() takes only that device_lock.  For a
  never-online SMT sibling, the first acpi_soft_cpu_online() probe can
  therefore overlap the same CPU's unbind and hit the 1002-1004 window
  (publish cpc_desc, then kobject_init_and_add()).



* Reproducer (attached: acpi_case1unbind.c) and results on 7.3

  The attached module starts a kthread that repeatedly calls the
  exported cppc_get_perf_caps(0, &caps), then the guest performs the
  real unbind:

    insmod /acpi_case1unbind.ko
    sleep 1
    echo cpu0 > /sys/bus/cpu/drivers/processor/unbind

  It does not modify kernel source.  It needs the test SSDT that
  provides the _CPC package, and the module build uses the same
  build-kasan-7.3 tree.

  Actual KASAN output (trimmed):

    CASE1UNBIND: unbinding cpu0
    BUG: KASAN: slab-use-after-free in cppc_get_perf_caps+0x14a/0x880
    Read of size 4 at addr ff110000019a6018 by task cppc_hammer_unb/73
    Call Trace:
     cppc_get_perf_caps+0x14a/0x880
     hammer_fn+0xf5/0x110 [acpi_case1unbind]
     kthread
    ...
    Allocated by task 20:
     acpi_cppc_processor_probe+0x174/0xe60
     acpi_soft_cpu_online+0x90/0x190
    ...
    Freed by task 1:
     kfree+0x121/0x390
     acpi_processor_stop+0x77/0x90
     device_release_driver_internal+0x246/0x2e0
     unbind_store+0xa9/0xb0
     kernfs_fop_write_iter+0x1ef/0x290
    ...
    CASE1UNBIND: unbind returned 0

  The allocation stack is the normal probe path, and the free stack is
  the real sysfs unbind path.  This confirms that the remove callback
  ran while CPU0 was online and that the published per-CPU pointer
  survived the free.  The module is an accessor stand-in: it does not
  prove the scheduler-tick timing or the system-memory iounmap
  sub-case, and the test kernel did not have cppc_cpufreq enabled.
  The core "exit frees, published pointer remains, accessor reads"
  lifetime is nevertheless demonstrated end to end.


* Suggested direction 

  Clear per_cpu(cpc_desc_ptr, pr->id) before releasing the object, and
  give accessors a real lifetime rule: an RCU/refcount-protected
  lookup, or a quiescence point that stops the cpufreq policy/FIE and
  waits for in-flight accessors before iounmap()/kfree().  The remove
  path should also refuse to run while the CPU is online (or offline
  and stop cpufreq first).  For the SMT path, make the first-online
  probe and driver remove share a lock, or exclude remove during the
  probe window.  If sysfs mappings remain reachable during removal,
  move iounmap() after the kernfs drain or protect the vaddr with the
  same lifetime mechanism.  Report-first, no patch attached; happy to
  test any proposal.


  Please keep me in Cc; I am not subscribed to the lists.



Regards,
Hanxiang Xu
xuhx@hust.edu.cn

[-- Attachment #2: acpi_case1unbind.c --]
[-- Type: text/plain, Size: 968 bytes --]

// SPDX-License-Identifier: GPL-2.0
#include <linux/module.h>
#include <linux/kthread.h>
#include <linux/delay.h>
#include <linux/acpi.h>
#include <acpi/cppc_acpi.h>

static struct task_struct *hammer;

static int hammer_fn(void *data)
{
	struct cppc_perf_caps caps;
	unsigned long n = 0;

	while (!kthread_should_stop()) {
		memset(&caps, 0, sizeof(caps));
		cppc_get_perf_caps(0, &caps);
		n++;
		if (!(n & 0x3ff))
			cond_resched();
	}
	pr_info("ACPI_CASE1UNBIND: hammer iterations=%lu\n", n);
	return 0;
}

static int __init case1unbind_init(void)
{
	hammer = kthread_run(hammer_fn, NULL, "cppc_hammer_unbind");
	if (IS_ERR(hammer)) {
		pr_err("ACPI_CASE1UNBIND: kthread_run failed\n");
		return PTR_ERR(hammer);
	}
	pr_info("ACPI_CASE1UNBIND: hammer started; unbind cpu0 now\n");
	return 0;
}

static void __exit case1unbind_exit(void)
{
	if (hammer)
		kthread_stop(hammer);
}

module_init(case1unbind_init);
module_exit(case1unbind_exit);
MODULE_LICENSE("GPL");