Revision 647e82dbf85124697be59a4b4cf00c0d38177dcb authored by Andy Shevchenko on 01 September 2022, 11:34:06 UTC, committed by Hans de Goede on 01 September 2022, 15:51:34 UTC
We have to copy only selected fields from the original resource. Because a PCI device will be removed immediately after getting its resources, we may not use any allocated data, hence we may not copy any pointers. Consider the following scenario: 1/ a caller of p2sb_bar() gets the resource; 2/ the resource has been copied by platform_device_add_data() in order to create a platform device; 3/ the platform device creation will call for the device driver's ->probe() as soon as a match found; 4/ the ->probe() takes given resources (see 2/) and tries to access one of its field, i.e. 'name', in the __devm_ioremap_resource() to create a pretty looking output; 5/ but the 'name' is a dangling pointer because p2sb_bar() removed a PCI device, which 'name' had been copied to the caller's memory. 6/ UAF (Use-After-Free) as a result. Kudos to Mika for the initial analisys of the issue. Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support") Reported-by: kernel test robot <oliver.sang@intel.com> Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com> Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/ Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/ Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
1 parent 5542dfc
sifive_edac.c
// SPDX-License-Identifier: GPL-2.0
/*
* SiFive Platform EDAC Driver
*
* Copyright (C) 2018-2019 SiFive, Inc.
*
* This driver is partially based on octeon_edac-pc.c
*
*/
#include <linux/edac.h>
#include <linux/platform_device.h>
#include "edac_module.h"
#include <soc/sifive/sifive_l2_cache.h>
#define DRVNAME "sifive_edac"
struct sifive_edac_priv {
struct notifier_block notifier;
struct edac_device_ctl_info *dci;
};
/*
* EDAC error callback
*
* @event: non-zero if unrecoverable.
*/
static
int ecc_err_event(struct notifier_block *this, unsigned long event, void *ptr)
{
const char *msg = (char *)ptr;
struct sifive_edac_priv *p;
p = container_of(this, struct sifive_edac_priv, notifier);
if (event == SIFIVE_L2_ERR_TYPE_UE)
edac_device_handle_ue(p->dci, 0, 0, msg);
else if (event == SIFIVE_L2_ERR_TYPE_CE)
edac_device_handle_ce(p->dci, 0, 0, msg);
return NOTIFY_OK;
}
static int ecc_register(struct platform_device *pdev)
{
struct sifive_edac_priv *p;
p = devm_kzalloc(&pdev->dev, sizeof(*p), GFP_KERNEL);
if (!p)
return -ENOMEM;
p->notifier.notifier_call = ecc_err_event;
platform_set_drvdata(pdev, p);
p->dci = edac_device_alloc_ctl_info(0, "sifive_ecc", 1, "sifive_ecc",
1, 1, NULL, 0,
edac_device_alloc_index());
if (!p->dci)
return -ENOMEM;
p->dci->dev = &pdev->dev;
p->dci->mod_name = "Sifive ECC Manager";
p->dci->ctl_name = dev_name(&pdev->dev);
p->dci->dev_name = dev_name(&pdev->dev);
if (edac_device_add_device(p->dci)) {
dev_err(p->dci->dev, "failed to register with EDAC core\n");
goto err;
}
register_sifive_l2_error_notifier(&p->notifier);
return 0;
err:
edac_device_free_ctl_info(p->dci);
return -ENXIO;
}
static int ecc_unregister(struct platform_device *pdev)
{
struct sifive_edac_priv *p = platform_get_drvdata(pdev);
unregister_sifive_l2_error_notifier(&p->notifier);
edac_device_del_device(&pdev->dev);
edac_device_free_ctl_info(p->dci);
return 0;
}
static struct platform_device *sifive_pdev;
static int __init sifive_edac_init(void)
{
int ret;
sifive_pdev = platform_device_register_simple(DRVNAME, 0, NULL, 0);
if (IS_ERR(sifive_pdev))
return PTR_ERR(sifive_pdev);
ret = ecc_register(sifive_pdev);
if (ret)
platform_device_unregister(sifive_pdev);
return ret;
}
static void __exit sifive_edac_exit(void)
{
ecc_unregister(sifive_pdev);
platform_device_unregister(sifive_pdev);
}
module_init(sifive_edac_init);
module_exit(sifive_edac_exit);
MODULE_AUTHOR("SiFive Inc.");
MODULE_DESCRIPTION("SiFive platform EDAC driver");
MODULE_LICENSE("GPL v2");
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...