• Tzung-Bi Shih's avatar
    platform/chrome: cros_ec_debugfs: detach log reader wq from devm · 0e8eb5e8
    Tzung-Bi Shih authored
    Debugfs console_log uses devm memory (e.g. debug_info in
    cros_ec_console_log_poll()).  However, lifecycles of device and debugfs
    are independent.  An use-after-free issue is observed if userland
    program operates the debugfs after the memory has been freed.
    
    The call trace:
     do_raw_spin_lock
     _raw_spin_lock_irqsave
     remove_wait_queue
     ep_unregister_pollwait
     ep_remove
     do_epoll_ctl
    
    A Python example to reproduce the issue:
    ... import select
    ... p = select.epoll()
    ... f = open('/sys/kernel/debug/cros_scp/console_log')
    ... p.register(f, select.POLLIN)
    ... p.poll(1)
    [(4, 1)]                    # 4=fd, 1=select.POLLIN
    
    [ shutdown cros_scp at the point ]
    
    ... p.poll(1)
    [(4, 16)]                   # 4=fd, 16=select.POLLHUP
    ... p.unregister(f)
    
    An use-after-free issue raises here.  It called epoll_ctl with
    EPOLL_CTL_DEL which in turn to use the workqueue in the devm (i.e.
    log_wq).
    
    Detaches log reader's workqueue from devm to make sure it is persistent
    even if the device has been removed.
    Signed-off-by: default avatarTzung-Bi Shih <tzungbi@google.com>
    Reviewed-by: default avatarGuenter Roeck <groeck@google.com>
    Link: https://lore.kernel.org/r/20220209051130.386175-1-tzungbi@google.comSigned-off-by: default avatarBenson Leung <bleung@chromium.org>
    0e8eb5e8
cros_ec_debugfs.c 13.3 KB