Patch "regulator: core: fix UAF in destroy_regulator()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    regulator: core: fix UAF in destroy_regulator()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     regulator-core-fix-uaf-in-destroy_regulator.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2f322fb850194a374c66817c9dc49236e8bc7ea6
Author: Yang Yingliang <yangyingliang@xxxxxxxxxx>
Date:   Wed Nov 16 11:37:06 2022 +0800

    regulator: core: fix UAF in destroy_regulator()
    
    [ Upstream commit 1f386d6894d0f1b7de8ef640c41622ddd698e7ab ]
    
    I got a UAF report as following:
    
    ==================================================================
    BUG: KASAN: use-after-free in __lock_acquire+0x935/0x2060
    Read of size 8 at addr ffff88810e838220 by task python3/268
    Call Trace:
     <TASK>
     dump_stack_lvl+0x67/0x83
     print_report+0x178/0x4b0
     kasan_report+0x90/0x190
     __lock_acquire+0x935/0x2060
     lock_acquire+0x156/0x400
     _raw_spin_lock+0x2a/0x40
     lockref_get+0x11/0x30
     simple_recursive_removal+0x41/0x440
     debugfs_remove.part.12+0x32/0x50
     debugfs_remove+0x29/0x30
     _regulator_put.cold.54+0x3e/0x27f
     regulator_put+0x1f/0x30
     release_nodes+0x6a/0xa0
     devres_release_all+0xf8/0x150
    
    Allocated by task 37:
     kasan_save_stack+0x1c/0x40
     kasan_set_track+0x21/0x30
     __kasan_slab_alloc+0x5d/0x70
     slab_post_alloc_hook+0x62/0x510
     kmem_cache_alloc_lru+0x222/0x5a0
     __d_alloc+0x31/0x440
     d_alloc+0x30/0xf0
     d_alloc_parallel+0xc4/0xd20
     __lookup_slow+0x15e/0x2f0
     lookup_one_len+0x13a/0x150
     start_creating+0xea/0x190
     debugfs_create_dir+0x1e/0x210
     create_regulator+0x254/0x4e0
     _regulator_get+0x2a1/0x467
     _devm_regulator_get+0x5a/0xb0
     regulator_virtual_probe+0xb9/0x1a0
    
    Freed by task 30:
     kasan_save_stack+0x1c/0x40
     kasan_set_track+0x21/0x30
     kasan_save_free_info+0x2a/0x50
     __kasan_slab_free+0x102/0x190
     kmem_cache_free+0xf6/0x600
     rcu_core+0x54c/0x12b0
     __do_softirq+0xf2/0x5e3
    
    Last potentially related work creation:
     kasan_save_stack+0x1c/0x40
     __kasan_record_aux_stack+0x98/0xb0
     call_rcu+0x42/0x700
     dentry_free+0x6c/0xd0
     __dentry_kill+0x23b/0x2d0
     dput.part.31+0x431/0x780
     simple_recursive_removal+0xa9/0x440
     debugfs_remove.part.12+0x32/0x50
     debugfs_remove+0x29/0x30
     regulator_unregister+0xe3/0x230
     release_nodes+0x6a/0xa0
    
    ==================================================================
    
    Here is how happened:
    
    processor A                                     processor B
    regulator_register()
      rdev_init_debugfs()
        rdev->debugfs = debugfs_create_dir()
                                                    devm_regulator_get()
                                                      rdev = regulator_dev_lookup()
                                                      create_regulator(rdev)
                                                        // using rdev->debugfs as parent
                                                        debugfs_create_dir(rdev->debugfs)
    
    mfd_remove_devices_fn()
      release_nodes()
        regulator_unregister()
          // free rdev->debugfs
          debugfs_remove_recursive(rdev->debugfs)
                                                    release_nodes()
                                                      destroy_regulator()
                                                        debugfs_remove_recursive() <- causes UAF
    
    In devm_regulator_get(), after getting rdev, the refcount
    is get, so fix this by moving debugfs_remove_recursive()
    to regulator_dev_release(), then it can be proctected by
    the refcount, the 'rdev->debugfs' can not be freed until
    the refcount is 0.
    
    Fixes: 5de705194e98 ("regulator: Add basic per consumer debugfs")
    Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221116033706.3595812-1-yangyingliang@xxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index f43c668e1630..eb083b26ab4f 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -4928,6 +4928,7 @@ static void regulator_dev_release(struct device *dev)
 {
 	struct regulator_dev *rdev = dev_get_drvdata(dev);
 
+	debugfs_remove_recursive(rdev->debugfs);
 	kfree(rdev->constraints);
 	of_node_put(rdev->dev.of_node);
 	kfree(rdev);
@@ -5438,7 +5439,6 @@ void regulator_unregister(struct regulator_dev *rdev)
 
 	mutex_lock(&regulator_list_mutex);
 
-	debugfs_remove_recursive(rdev->debugfs);
 	WARN_ON(rdev->open_count);
 	regulator_remove_coupling(rdev);
 	unset_regulator_supplies(rdev);