• Jan Glauber's avatar
    mmc: cavium: Fix use-after-free in of_platform_device_destroy · b917c6d1
    Jan Glauber authored
    KASAN reported the following:
    
    [   19.338655] ==================================================================
    [   19.345946] BUG: KASAN: use-after-free in of_platform_device_destroy+0x88/0x100
    [   19.345966] Read of size 8 at addr fffffe01aa6f1468 by task systemd-udevd/264
    
    [   19.345983] CPU: 1 PID: 264 Comm: systemd-udevd Not tainted 4.13.0-jang+ #737
    [   19.345989] Hardware name: Cavium ThunderX CN81XX board (DT)
    [   19.345995] Call trace:
    [   19.346013] [<fffffc800808b1b0>] dump_backtrace+0x0/0x368
    [   19.346026] [<fffffc800808b6bc>] show_stack+0x24/0x30
    [   19.346040] [<fffffc8008cbb944>] dump_stack+0xa4/0xc8
    [   19.346057] [<fffffc80082c2870>] print_address_description+0x68/0x258
    [   19.346070] [<fffffc80082c2d70>] kasan_report+0x238/0x2f8
    [   19.346082] [<fffffc80082c14a8>] __asan_load8+0x88/0xb8
    [   19.346098] [<fffffc8008aacee0>] of_platform_device_destroy+0x88/0x100
    [   19.346131] [<fffffc8000e02fa4>] thunder_mmc_probe+0x314/0x550 [thunderx_mmc]
    [   19.346147] [<fffffc800879d560>] pci_device_probe+0x158/0x1f8
    [   19.346162] [<fffffc800886e53c>] driver_probe_device+0x394/0x5f8
    [   19.346174] [<fffffc800886e8f4>] __driver_attach+0x154/0x158
    [   19.346185] [<fffffc800886b12c>] bus_for_each_dev+0xdc/0x140
    [   19.346196] [<fffffc800886d9f8>] driver_attach+0x38/0x48
    [   19.346207] [<fffffc800886d148>] bus_add_driver+0x290/0x3c8
    [   19.346219] [<fffffc800886fc5c>] driver_register+0xbc/0x1a0
    [   19.346232] [<fffffc800879b78c>] __pci_register_driver+0xc4/0xd8
    [   19.346260] [<fffffc8000e80024>] thunder_mmc_driver_init+0x24/0x10000 [thunderx_mmc]
    [   19.346273] [<fffffc8008083a80>] do_one_initcall+0x98/0x1c0
    [   19.346289] [<fffffc8008177b54>] do_init_module+0xe0/0x2cc
    [   19.346303] [<fffffc8008175cf0>] load_module+0x3238/0x35c0
    [   19.346318] [<fffffc8008176438>] SyS_finit_module+0x190/0x1a0
    [   19.346329] [<fffffc80080834a0>] __sys_trace_return+0x0/0x4
    
    This is caused by:
    
      platform_device_register()
       -> platform_device_unregister(to_platform_device(dev))
    	freeing struct device
       -> of_node_clear_flag(dev->of_node, ...)
    	writing to the freed device
    
    The issue is solved by increasing the reference count before calling
    of_platform_device_destroy() so freeing the device is postponed after
    the call.
    
    Fixes: 8fb83b14 ("mmc: cavium: Fix probing race with regulator")
    Signed-off-by: default avatarJan Glauber <jglauber@cavium.com>
    Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
    b917c6d1
cavium-thunderx.c 4.81 KB