Patch "cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory" has been added to the 5.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory

to the 5.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     cpufreq-schedutil-destroy-mutex-before-kobject_put-f.patch
and it can be found in the queue-5.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 75fd712db437964333f0958e6ab97c8edec858fb
Author: James Morse <james.morse@xxxxxxx>
Date:   Tue Sep 14 16:56:23 2021 +0000

    cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
    
    [ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ]
    
    Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release()
    method to free sugov_tunables") kobject_put() has kfree()d the
    attr_set before gov_attr_set_put() returns.
    
    kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
    the subsequent mutex_destroy() triggers a use-after-free:
    | BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
    | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
    |
    | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
    | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
    | Platform, BIOS EDK II Jul 30 2018
    | Call trace:
    |  dump_backtrace+0x0/0x380
    |  show_stack+0x1c/0x30
    |  dump_stack_lvl+0x8c/0xb8
    |  print_address_description.constprop.0+0x74/0x2b8
    |  kasan_report+0x1f4/0x210
    |  kasan_check_range+0xfc/0x1a4
    |  __kasan_check_read+0x38/0x60
    |  mutex_is_locked+0x20/0x60
    |  mutex_destroy+0x80/0x100
    |  gov_attr_set_put+0xfc/0x150
    |  sugov_exit+0x78/0x190
    |  cpufreq_offline.isra.0+0x2c0/0x660
    |  cpuhp_cpufreq_offline+0x14/0x24
    |  cpuhp_invoke_callback+0x430/0x6d0
    |  cpuhp_thread_fun+0x1b0/0x624
    |  smpboot_thread_fn+0x5e0/0xa6c
    |  kthread+0x3a0/0x450
    |  ret_from_fork+0x10/0x20
    
    Swap the order of the calls.
    
    Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
    Cc: 4.7+ <stable@xxxxxxxxxxxxxxx> # 4.7+
    Signed-off-by: James Morse <james.morse@xxxxxxx>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
index 66b05a326910..a6f365b9cc1a 100644
--- a/drivers/cpufreq/cpufreq_governor_attr_set.c
+++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
@@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
 	if (count)
 		return count;
 
-	kobject_put(&attr_set->kobj);
 	mutex_destroy(&attr_set->update_lock);
+	kobject_put(&attr_set->kobj);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(gov_attr_set_put);