mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 06:33:07 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/cpufreq
History
James Morse 514643eadf cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory 
[ Upstream commit cdef119660 ]

Since commit e5c6b312ce ("cpufreq: schedutil: Use kobject release()
method to free sugov_tunables") kobject_put() has kfree()d the
attr_set before gov_attr_set_put() returns.

kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
the subsequent mutex_destroy() triggers a use-after-free:
| BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
| Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
|
| CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
| Platform, BIOS EDK II Jul 30 2018
| Call trace:
|  dump_backtrace+0x0/0x380
|  show_stack+0x1c/0x30
|  dump_stack_lvl+0x8c/0xb8
|  print_address_description.constprop.0+0x74/0x2b8
|  kasan_report+0x1f4/0x210
|  kasan_check_range+0xfc/0x1a4
|  __kasan_check_read+0x38/0x60
|  mutex_is_locked+0x20/0x60
|  mutex_destroy+0x80/0x100
|  gov_attr_set_put+0xfc/0x150
|  sugov_exit+0x78/0x190
|  cpufreq_offline.isra.0+0x2c0/0x660
|  cpuhp_cpufreq_offline+0x14/0x24
|  cpuhp_invoke_callback+0x430/0x6d0
|  cpuhp_thread_fun+0x1b0/0x624
|  smpboot_thread_fn+0x5e0/0xa6c
|  kthread+0x3a0/0x450
|  ret_from_fork+0x10/0x20

Swap the order of the calls.

Fixes: e5c6b312ce ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-10-06 15:05:08 +02:00
..
acpi-cpufreq.c acpi-cpufreq: Honor _PSD table setting on new AMD CPUs 2020-11-05 11:06:59 +01:00
amd_freq_sensitivity.c
arm_big_little.c cpufreq: arm_big_little: Make ->get_transition_latency() mandatory 2017-07-26 00:15:44 +02:00
arm_big_little.h
arm_big_little_dt.c
at32ap-cpufreq.c
blackfin-cpufreq.c
bmips-cpufreq.c
brcmstb-avs-cpufreq.c cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() 2021-03-03 18:22:38 +01:00
cppc_cpufreq.c cpufreq / CPPC: Set platform specific transition_delay_us 2018-07-22 14:28:42 +02:00
cpufreq-dt-platdev.c cpufreq: mediatek: add mediatek related projects into blacklist 2018-02-16 20:22:43 +01:00
cpufreq-dt.c cpufreq: dt: Try freeing static OPPs only if we have added them 2018-11-13 11:14:54 -08:00
cpufreq-dt.h
cpufreq-nforce2.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
cpufreq.c cpufreq: Register drivers only after CPU devices have been registered 2019-12-31 12:37:40 +01:00
cpufreq_conservative.c cpufreq: conservative: Take limits changes into account properly 2018-11-13 11:14:45 -08:00
cpufreq_governor.c sched/cpufreq: Fix kobject memleak 2019-05-31 06:47:19 -07:00
cpufreq_governor.h cpufreq: Replace "max_transition_latency" with "dynamic_switching" 2017-07-26 00:15:45 +02:00
cpufreq_governor_attr_set.c cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory 2021-10-06 15:05:08 +02:00
cpufreq_ondemand.c cpufreq: governor: Drop min_sampling_rate 2017-07-22 02:25:20 +02:00
cpufreq_ondemand.h
cpufreq_performance.c
cpufreq_powersave.c
cpufreq_stats.c Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux 2017-07-14 13:12:32 -07:00
cpufreq_userspace.c
cris-artpec3-cpufreq.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cris-etraxfs-cpufreq.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
davinci-cpufreq.c
e_powersaver.c
elanfreq.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
exynos5440-cpufreq.c cpufreq: exynos5440: Fix inconsistent indenting 2017-06-24 01:38:00 +02:00
freq_table.c
gx-suspmod.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
highbank-cpufreq.c cpufreq: highbank: Add missing MODULE_DEVICE_TABLE 2020-12-29 13:46:59 +01:00
ia64-acpi-cpufreq.c cpufreq/ia64: Replace racy task affinity logic 2017-04-15 12:20:55 +02:00
imx6q-cpufreq.c cpufreq: imx6q: add return value check for voltage scale 2018-12-01 09:42:53 +01:00
intel_pstate.c cpufreq: intel_pstate: Refuse to turn off with HWP enabled 2020-09-23 10:46:27 +02:00
Kconfig cpufreq: Add Loongson machine dependencies 2018-02-03 17:39:00 +01:00
Kconfig.arm cpufreq: dbx500: Delete obsolete driver 2017-08-22 15:50:02 +02:00
Kconfig.powerpc
Kconfig.x86
kirkwood-cpufreq.c cpufreq: kirkwood: fix possible object reference leak 2019-05-31 06:47:29 -07:00
longhaul.c cpufreq: longhaul: Revert transition_delay_us to 200 ms 2018-03-24 11:01:21 +01:00
longhaul.h
longrun.c cpufreq: Don't set transition_latency for setpolicy drivers 2017-07-26 00:15:43 +02:00
loongson1-cpufreq.c cpufreq: loongson1: Add missing MODULE_ALIAS 2020-12-29 13:46:59 +01:00
loongson2_cpufreq.c cpufreq: Loongson2: constify platform_device_id 2017-08-18 01:44:21 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
maple-cpufreq.c
mediatek-cpufreq.c cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE 2020-12-29 13:46:59 +01:00
mvebu-cpufreq.c
omap-cpufreq.c
p4-clockmod.c x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-22 15:42:24 +01:00
pasemi-cpufreq.c cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() 2019-08-16 10:13:52 +02:00
pcc-cpufreq.c cpufreq: intel_pstate: Register when ACPI PCCH is present 2018-07-25 11:25:08 +02:00
pmac32-cpufreq.c cpufreq: pmac32: fix possible object reference leak 2019-05-31 06:47:29 -07:00
pmac64-cpufreq.c cpufreq: Convert to using %pOF instead of full_name 2017-08-25 01:20:46 +02:00
powernow-k6.c
powernow-k7.c x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-22 15:42:24 +01:00
powernow-k7.h
powernow-k8.c cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() 2021-01-17 13:58:59 +01:00
powernow-k8.h
powernv-cpufreq.c cpufreq: powernv: Fix init_chip_info initialization in numa=off 2021-09-22 11:45:32 +02:00
ppc_cbe_cpufreq.c cpufreq: ppc_cbe: fix possible object reference leak 2019-05-31 06:47:28 -07:00
ppc_cbe_cpufreq.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ppc_cbe_cpufreq_pervasive.c
ppc_cbe_cpufreq_pmi.c
pxa2xx-cpufreq.c cpufreq: pxa2xx: remove incorrect __init annotation 2019-03-23 14:35:22 +01:00
pxa3xx-cpufreq.c
qoriq-cpufreq.c thermal: cpu_cooling: use cpufreq_policy to register cooling device 2017-05-27 17:32:24 -07:00
s3c24xx-cpufreq-debugfs.c
s3c24xx-cpufreq.c cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() 2018-03-08 22:41:06 -08:00
s3c64xx-cpufreq.c
s3c2410-cpufreq.c
s3c2412-cpufreq.c
s3c2416-cpufreq.c
s3c2440-cpufreq.c
s5pv210-cpufreq.c cpufreq: s5pv210: add missing of_node_put() 2017-07-26 22:54:01 +02:00
sa1100-cpufreq.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
sa1110-cpufreq.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
sc520_freq.c
scpi-cpufreq.c cpufreq: scpi: Add missing MODULE_ALIAS 2020-12-29 13:46:59 +01:00
sfi-cpufreq.c cpufreq: sfi: make freq_table static 2017-06-24 01:43:21 +02:00
sh-cpufreq.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
sparc-us2e-cpufreq.c cpufreq/sparc-us2e: Replace racy task affinity logic 2017-04-15 12:20:56 +02:00
sparc-us3-cpufreq.c cpufreq/sparc-us3: Replace racy task affinity logic 2017-04-15 12:20:55 +02:00
spear-cpufreq.c
speedstep-centrino.c x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-22 15:42:24 +01:00
speedstep-ich.c cpufreq: speedstep: remove unnecessary static in speedstep_detect_chipset() 2017-07-16 02:12:35 +02:00
speedstep-lib.c x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-22 15:42:24 +01:00
speedstep-lib.h
speedstep-smi.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
sti-cpufreq.c cpufreq: st: Add missing MODULE_DEVICE_TABLE 2020-12-29 13:46:59 +01:00
tango-cpufreq.c cpufreq: dt: Don't use generic platdev driver for tango 2017-07-22 02:20:59 +02:00
tegra20-cpufreq.c
tegra124-cpufreq.c cpufreq: tegra124: add missing of_node_put() 2019-03-23 14:35:22 +01:00
tegra186-cpufreq.c cpufreq: Add Tegra186 cpufreq driver 2017-04-19 23:23:08 +02:00
ti-cpufreq.c cpufreq: ti-cpufreq: add missing of_node_put() 2019-11-12 19:18:28 +01:00
unicore2-cpufreq.c cpufreq: Add CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING cpufreq driver flag 2017-07-26 00:15:46 +02:00
vexpress-spc-cpufreq.c