On Wed, Oct 16, 2024 at 02:13:38PM GMT, Xinqi Zhang wrote:
> The scmi_dev->name is released prematurely in __scmi_device_destroy(),
> which causes slab-use-after-free when accessing scmi_dev->name in
> scmi_bus_notifier(). So move the release of scmi_dev->name to
> scmi_device_release() to avoid slab-use-after-free.
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
> Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1
>
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
> Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
> Call trace:
> dump_backtrace+0x94/0x114
> show_stack+0x18/0x24
> dump_stack_lvl+0x48/0x60
> print_report+0xf4/0x5b0
> kasan_report+0xa4/0xec
> __asan_report_load1_noabort+0x20/0x2c
> strncmp+0xe4/0xec
> scmi_bus_notifier+0x5c/0x54c
> notifier_call_chain+0xb4/0x31c
> blocking_notifier_call_chain+0x68/0x9c
> bus_notify+0x54/0x78
> device_del+0x1bc/0x840
> device_unregister+0x20/0xb4
> __scmi_device_destroy+0xac/0x280
> scmi_device_destroy+0x94/0xd0
> scmi_chan_setup+0x524/0x750
> scmi_probe+0x7fc/0x1508
> platform_probe+0xc4/0x19c
> really_probe+0x32c/0x99c
> __driver_probe_device+0x15c/0x3c4
> driver_probe_device+0x5c/0x170
> __driver_attach+0x1c8/0x440
> bus_for_each_dev+0xf4/0x178
> driver_attach+0x3c/0x58
> bus_add_driver+0x234/0x4d4
> driver_register+0xf4/0x3c0
> __platform_driver_register+0x60/0x88
> scmi_driver_init+0xb0/0x104
> do_one_initcall+0xb4/0x664
> kernel_init_freeable+0x3c8/0x894
> kernel_init+0x24/0x1e8
> ret_from_fork+0x10/0x20
>
> Allocated by task 1:
> kasan_save_stack+0x2c/0x54
> kasan_set_track+0x2c/0x40
> kasan_save_alloc_info+0x24/0x34
> __kasan_kmalloc+0xa0/0xb8
> __kmalloc_node_track_caller+0x6c/0x104
> kstrdup+0x48/0x84
> kstrdup_const+0x34/0x40
> __scmi_device_create.part.0+0x8c/0x408
> scmi_device_create+0x104/0x370
> scmi_chan_setup+0x2a0/0x750
> scmi_probe+0x7fc/0x1508
> platform_probe+0xc4/0x19c
> really_probe+0x32c/0x99c
> __driver_probe_device+0x15c/0x3c4
> driver_probe_device+0x5c/0x170
> __driver_attach+0x1c8/0x440
> bus_for_each_dev+0xf4/0x178
> driver_attach+0x3c/0x58
> bus_add_driver+0x234/0x4d4
> driver_register+0xf4/0x3c0
> __platform_driver_register+0x60/0x88
> scmi_driver_init+0xb0/0x104
> do_one_initcall+0xb4/0x664
> kernel_init_freeable+0x3c8/0x894
> kernel_init+0x24/0x1e8
> ret_from_fork+0x10/0x20
>
> Freed by task 1:
> kasan_save_stack+0x2c/0x54
> kasan_set_track+0x2c/0x40
> kasan_save_free_info+0x38/0x5c
> __kasan_slab_free+0xe8/0x164
> __kmem_cache_free+0x11c/0x230
> kfree+0x70/0x130
> kfree_const+0x20/0x40
> __scmi_device_destroy+0x70/0x280
> scmi_device_destroy+0x94/0xd0
> scmi_chan_setup+0x524/0x750
> scmi_probe+0x7fc/0x1508
> platform_probe+0xc4/0x19c
> really_probe+0x32c/0x99c
> __driver_probe_device+0x15c/0x3c4
> driver_probe_device+0x5c/0x170
> __driver_attach+0x1c8/0x440
> bus_for_each_dev+0xf4/0x178
> driver_attach+0x3c/0x58
> bus_add_driver+0x234/0x4d4
> driver_register+0xf4/0x3c0
> __platform_driver_register+0x60/0x88
> scmi_driver_init+0xb0/0x104
> do_one_initcall+0xb4/0x664
> kernel_init_freeable+0x3c8/0x894
> kernel_init+0x24/0x1e8
> ret_from_fork+0x10/0x20
>
> Fixes: ee7a9c9f67c5 ("firmware: arm_scmi: Add support for multiple device per protocol")
> Signed-off-by: Xinqi Zhang <quic_xinqzhan@xxxxxxxxxxx>
Reviewed-by: Bjorn Andersson <andersson@xxxxxxxxxx>
Regards,
Bjorn
> ---
> Changes in v2:
> - Standardize commit messages and add Fixes tags.
> - Link to v1: https://lore.kernel.org/r/20241015-fix-arm-scmi-slab-use-after-free-v1-1-b006eba9c8df@xxxxxxxxxxx
> ---
> drivers/firmware/arm_scmi/bus.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
> index 96b2e5f9a8ef0386525f9d91d2925e7e6d48ac28..157172a5f2b577ce4f04425f967f548230c1ebed 100644
> --- a/drivers/firmware/arm_scmi/bus.c
> +++ b/drivers/firmware/arm_scmi/bus.c
> @@ -325,7 +325,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister);
>
> static void scmi_device_release(struct device *dev)
> {
> - kfree(to_scmi_dev(dev));
> + struct scmi_device *scmi_dev = to_scmi_dev(dev);
> +
> + kfree_const(scmi_dev->name);
> + kfree(scmi_dev);
> }
>
> static void __scmi_device_destroy(struct scmi_device *scmi_dev)
> @@ -338,7 +341,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev)
> if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM)
> atomic_set(&scmi_syspower_registered, 0);
>
> - kfree_const(scmi_dev->name);
> ida_free(&scmi_bus_id, scmi_dev->id);
> device_unregister(&scmi_dev->dev);
> }
> @@ -410,7 +412,6 @@ __scmi_device_create(struct device_node *np, struct device *parent,
>
> return scmi_dev;
> put_dev:
> - kfree_const(scmi_dev->name);
> put_device(&scmi_dev->dev);
> ida_free(&scmi_bus_id, id);
> return NULL;
>
> ---
> base-commit: eca631b8fe808748d7585059c4307005ca5c5820
> change-id: 20241015-fix-arm-scmi-slab-use-after-free-74e358b3c90c
>
> Best regards,
> --
> Xinqi Zhang <quic_xinqzhan@xxxxxxxxxxx>
>
>
