Messages in this thread | | | From | Fei Shao <> | Date | Fri, 18 Aug 2023 13:09:04 +0800 | Subject | Re: [PATCH] spmi: mediatek: Fix UAF on device remove |
| |
Just to float this up. Any feedback on this?
On Tue, Jul 18, 2023 at 2:57 PM Fei Shao <fshao@chromium.org> wrote: > > On Mon, Jul 17, 2023 at 5:41 PM Yu-Che Cheng <giver@chromium.org> wrote: > > > > The pmif driver data that contains the clocks is allocated along with > > spmi_controller. > > On device remove, spmi_controller will be freed first, and then devres > > , including the clocks, will be cleanup. > > This leads to UAF because putting the clocks will access the clocks in > > the pmif driver data, which is already freed along with spmi_controller. > > > > This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and > > building the kernel with KASAN. > > > > Fix the UAF issue by using unmanaged clk_bulk_get() and putting the > > clocks before freeing spmi_controller. > > > > Reported-by: Fei Shao <fshao@chromium.org> > > Signed-off-by: Yu-Che Cheng <giver@chromium.org> > > Reviewed-by: Fei Shao <fshao@chromium.org> > Tested-by: Fei Shao <fshao@chromium.org>
| |