mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-30 08:02:30 +00:00
0a5c26712f
When device_register() return failed, program will goto out_kfree_type
to release 'cdev->device' by put_device(). That will call thermal_release()
to free 'cdev'. But the follow-up processes access 'cdev' continually.
That trggers the UAF bug.
====================================================================
BUG: KASAN: use-after-free in __thermal_cooling_device_register+0x75b/0xa90
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
dump_stack_lvl+0xe2/0x152
print_address_description.constprop.0+0x21/0x140
? __thermal_cooling_device_register+0x75b/0xa90
kasan_report.cold+0x7f/0x11b
? __thermal_cooling_device_register+0x75b/0xa90
__thermal_cooling_device_register+0x75b/0xa90
? memset+0x20/0x40
? __sanitizer_cov_trace_pc+0x1d/0x50
? __devres_alloc_node+0x130/0x180
devm_thermal_of_cooling_device_register+0x67/0xf0
max6650_probe.cold+0x557/0x6aa
......
Freed by task 258:
kasan_save_stack+0x1b/0x40
kasan_set_track+0x1c/0x30
kasan_set_free_info+0x20/0x30
__kasan_slab_free+0x109/0x140
kfree+0x117/0x4c0
thermal_release+0xa0/0x110
device_release+0xa7/0x240
kobject_put+0x1ce/0x540
put_device+0x20/0x30
__thermal_cooling_device_register+0x731/0xa90
devm_thermal_of_cooling_device_register+0x67/0xf0
max6650_probe.cold+0x557/0x6aa [max6650]
Do not use 'cdev' again after put_device() to fix the problem like doing
in thermal_zone_device_register().
[dlezcano]: as requested by Rafael, change the affectation into two statements.
Fixes:
|
||
|---|---|---|
| .. | ||
| broadcom | ||
| intel | ||
| qcom | ||
| samsung | ||
| st | ||
| tegra | ||
| ti-soc-thermal | ||
| amlogic_thermal.c | ||
| armada_thermal.c | ||
| cpufreq_cooling.c | ||
| cpuidle_cooling.c | ||
| da9062-thermal.c | ||
| db8500_thermal.c | ||
| devfreq_cooling.c | ||
| dove_thermal.c | ||
| gov_bang_bang.c | ||
| gov_fair_share.c | ||
| gov_power_allocator.c | ||
| gov_step_wise.c | ||
| gov_user_space.c | ||
| hisi_thermal.c | ||
| imx8mm_thermal.c | ||
| imx_sc_thermal.c | ||
| imx_thermal.c | ||
| k3_bandgap.c | ||
| Kconfig | ||
| khadas_mcu_fan.c | ||
| kirkwood_thermal.c | ||
| Makefile | ||
| max77620_thermal.c | ||
| mtk_thermal.c | ||
| qoriq_thermal.c | ||
| rcar_gen3_thermal.c | ||
| rcar_thermal.c | ||
| rockchip_thermal.c | ||
| spear_thermal.c | ||
| sprd_thermal.c | ||
| sun8i_thermal.c | ||
| thermal-generic-adc.c | ||
| thermal_core.c | ||
| thermal_core.h | ||
| thermal_helpers.c | ||
| thermal_hwmon.c | ||
| thermal_hwmon.h | ||
| thermal_mmio.c | ||
| thermal_netlink.c | ||
| thermal_netlink.h | ||
| thermal_of.c | ||
| thermal_sysfs.c | ||
| uniphier_thermal.c | ||