Re: [PATCH] spmi: mediatek: Fix UAF on device remove
flat view
From: Fei Shao <hidden>
Date: 2023-08-18 05:10:30
Also in:
linux-mediatek, lkml
Just to float this up. Any feedback on this? On Tue, Jul 18, 2023 at 2:57 PM Fei Shao [off-list ref] wrote:
On Mon, Jul 17, 2023 at 5:41 PM Yu-Che Cheng [off-list ref] wrote:quoted
The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the clocks in the pmif driver data, which is already freed along with spmi_controller. This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and building the kernel with KASAN. Fix the UAF issue by using unmanaged clk_bulk_get() and putting the clocks before freeing spmi_controller. Reported-by: Fei Shao <redacted> Signed-off-by: Yu-Che Cheng <redacted>Reviewed-by: Fei Shao <redacted> Tested-by: Fei Shao <redacted>
_______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel