lkml.org 
[lkml]   [2021]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 030/101] dmaengine: mediatek: free the proper desc in desc_free handler
    Date
    From: Guillaume Ranquet <granquet@baylibre.com>

    [ Upstream commit 0a2ff58f9f8f95526ecb0ccd7517fefceb96f661 ]

    The desc_free handler assumed that the desc we want to free was always
    the current one associated with the channel.

    This is seldom the case and this is causing use after free crashes in
    multiple places (tx/rx/terminate...).

    BUG: KASAN: use-after-free in mtk_uart_apdma_rx_handler+0x120/0x304

    Call trace:
    dump_backtrace+0x0/0x1b0
    show_stack+0x24/0x34
    dump_stack+0xe0/0x150
    print_address_description+0x8c/0x55c
    __kasan_report+0x1b8/0x218
    kasan_report+0x14/0x20
    __asan_load4+0x98/0x9c
    mtk_uart_apdma_rx_handler+0x120/0x304
    mtk_uart_apdma_irq_handler+0x50/0x80
    __handle_irq_event_percpu+0xe0/0x210
    handle_irq_event+0x8c/0x184
    handle_fasteoi_irq+0x1d8/0x3ac
    __handle_domain_irq+0xb0/0x110
    gic_handle_irq+0x50/0xb8
    el0_irq_naked+0x60/0x6c

    Allocated by task 3541:
    __kasan_kmalloc+0xf0/0x1b0
    kasan_kmalloc+0x10/0x1c
    kmem_cache_alloc_trace+0x90/0x2dc
    mtk_uart_apdma_prep_slave_sg+0x6c/0x1a0
    mtk8250_dma_rx_complete+0x220/0x2e4
    vchan_complete+0x290/0x340
    tasklet_action_common+0x220/0x298
    tasklet_action+0x28/0x34
    __do_softirq+0x158/0x35c

    Freed by task 3541:
    __kasan_slab_free+0x154/0x224
    kasan_slab_free+0x14/0x24
    slab_free_freelist_hook+0xf8/0x15c
    kfree+0xb4/0x278
    mtk_uart_apdma_desc_free+0x34/0x44
    vchan_complete+0x1bc/0x340
    tasklet_action_common+0x220/0x298
    tasklet_action+0x28/0x34
    __do_softirq+0x158/0x35c

    The buggy address belongs to the object at ffff000063606800
    which belongs to the cache kmalloc-256 of size 256
    The buggy address is located 176 bytes inside of
    256-byte region [ffff000063606800, ffff000063606900)
    The buggy address belongs to the page:
    page:fffffe00016d8180 refcount:1 mapcount:0 mapping:ffff00000302f600 index:0x0 compound_mapcount: 0
    flags: 0xffff00000010200(slab|head)
    raw: 0ffff00000010200 dead000000000100 dead000000000122 ffff00000302f600
    raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected

    Signed-off-by: Guillaume Ranquet <granquet@baylibre.com>

    Link: https://lore.kernel.org/r/20210513192642.29446-2-granquet@baylibre.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/dma/mediatek/mtk-uart-apdma.c | 5 +----
    1 file changed, 1 insertion(+), 4 deletions(-)

    diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
    index 27c07350971d..e38b67fc0c0c 100644
    --- a/drivers/dma/mediatek/mtk-uart-apdma.c
    +++ b/drivers/dma/mediatek/mtk-uart-apdma.c
    @@ -131,10 +131,7 @@ static unsigned int mtk_uart_apdma_read(struct mtk_chan *c, unsigned int reg)

    static void mtk_uart_apdma_desc_free(struct virt_dma_desc *vd)
    {
    - struct dma_chan *chan = vd->tx.chan;
    - struct mtk_chan *c = to_mtk_uart_apdma_chan(chan);
    -
    - kfree(c->desc);
    + kfree(container_of(vd, struct mtk_uart_apdma_desc, vd));
    }

    static void mtk_uart_apdma_start_tx(struct mtk_chan *c)
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-28 16:35    [W:4.071 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site