mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2025-01-15 21:23:23 +00:00
c79a39dc8d
On a board running ntpd and gpsd, I'm seeing a consistent use-after-free
in sys_exit() from gpsd when rebooting:
pps pps1: removed
------------[ cut here ]------------
kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150
CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1
Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : kobject_put+0x120/0x150
lr : kobject_put+0x120/0x150
sp : ffffffc0803d3ae0
x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001
x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440
x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600
x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20
x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
kobject_put+0x120/0x150
cdev_put+0x20/0x3c
__fput+0x2c4/0x2d8
____fput+0x1c/0x38
task_work_run+0x70/0xfc
do_exit+0x2a0/0x924
do_group_exit+0x34/0x90
get_signal+0x7fc/0x8c0
do_signal+0x128/0x13b4
do_notify_resume+0xdc/0x160
el0_svc+0xd4/0xf8
el0t_64_sync_handler+0x140/0x14c
el0t_64_sync+0x190/0x194
---[ end trace 0000000000000000 ]---
...followed by more symptoms of corruption, with similar stacks:
refcount_t: underflow; use-after-free.
kernel BUG at lib/list_debug.c:62!
Kernel panic - not syncing: Oops - BUG: Fatal exception
This happens because pps_device_destruct() frees the pps_device with the
embedded cdev immediately after calling cdev_del(), but, as the comment
above cdev_del() notes, fops for previously opened cdevs are still
callable even after cdev_del() returns. I think this bug has always
been there: I can't explain why it suddenly started happening every time
I reboot this particular board.
In commit d953e0e837e6 ("pps: Fix a use-after free bug when
unregistering a source."), George Spelvin suggested removing the
embedded cdev. That seems like the simplest way to fix this, so I've
implemented his suggestion, using __register_chrdev() with pps_idr
becoming the source of truth for which minor corresponds to which
device.
But now that pps_idr defines userspace visibility instead of cdev_add(),
we need to be sure the pps->dev refcount can't reach zero while
userspace can still find it again. So, the idr_remove() call moves to
pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.
pps_core: source serial1 got cdev (251:1)
<...>
pps pps1: removed
pps_core: unregistering pps1
pps_core: deallocating pps1
Fixes: d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source.")
Cc: stable@vger.kernel.org
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
Link: https://lore.kernel.org/r/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
120 lines
2.9 KiB
C
120 lines
2.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* PPS API kernel header
|
|
*
|
|
* Copyright (C) 2009 Rodolfo Giometti <giometti@linux.it>
|
|
*/
|
|
|
|
#ifndef LINUX_PPS_KERNEL_H
|
|
#define LINUX_PPS_KERNEL_H
|
|
|
|
#include <linux/pps.h>
|
|
#include <linux/cdev.h>
|
|
#include <linux/device.h>
|
|
#include <linux/time.h>
|
|
|
|
/*
|
|
* Global defines
|
|
*/
|
|
|
|
struct pps_device;
|
|
|
|
/* The specific PPS source info */
|
|
struct pps_source_info {
|
|
char name[PPS_MAX_NAME_LEN]; /* symbolic name */
|
|
char path[PPS_MAX_NAME_LEN]; /* path of connected device */
|
|
int mode; /* PPS allowed mode */
|
|
|
|
void (*echo)(struct pps_device *pps,
|
|
int event, void *data); /* PPS echo function */
|
|
|
|
struct module *owner;
|
|
struct device *dev; /* Parent device for device_create */
|
|
};
|
|
|
|
struct pps_event_time {
|
|
#ifdef CONFIG_NTP_PPS
|
|
struct timespec64 ts_raw;
|
|
#endif /* CONFIG_NTP_PPS */
|
|
struct timespec64 ts_real;
|
|
};
|
|
|
|
/* The main struct */
|
|
struct pps_device {
|
|
struct pps_source_info info; /* PSS source info */
|
|
|
|
struct pps_kparams params; /* PPS current params */
|
|
|
|
__u32 assert_sequence; /* PPS assert event seq # */
|
|
__u32 clear_sequence; /* PPS clear event seq # */
|
|
struct pps_ktime assert_tu;
|
|
struct pps_ktime clear_tu;
|
|
int current_mode; /* PPS mode at event time */
|
|
|
|
unsigned int last_ev; /* last PPS event id */
|
|
wait_queue_head_t queue; /* PPS event queue */
|
|
|
|
unsigned int id; /* PPS source unique ID */
|
|
void const *lookup_cookie; /* For pps_lookup_dev() only */
|
|
struct device dev;
|
|
struct fasync_struct *async_queue; /* fasync method */
|
|
spinlock_t lock;
|
|
};
|
|
|
|
/*
|
|
* Global variables
|
|
*/
|
|
|
|
extern const struct attribute_group *pps_groups[];
|
|
|
|
/*
|
|
* Internal functions.
|
|
*
|
|
* These are not actually part of the exported API, but this is a
|
|
* convenient header file to put them in.
|
|
*/
|
|
|
|
extern int pps_register_cdev(struct pps_device *pps);
|
|
extern void pps_unregister_cdev(struct pps_device *pps);
|
|
|
|
/*
|
|
* Exported functions
|
|
*/
|
|
|
|
extern struct pps_device *pps_register_source(
|
|
struct pps_source_info *info, int default_params);
|
|
extern void pps_unregister_source(struct pps_device *pps);
|
|
extern void pps_event(struct pps_device *pps,
|
|
struct pps_event_time *ts, int event, void *data);
|
|
/* Look up a pps_device by magic cookie */
|
|
struct pps_device *pps_lookup_dev(void const *cookie);
|
|
|
|
static inline void timespec_to_pps_ktime(struct pps_ktime *kt,
|
|
struct timespec64 ts)
|
|
{
|
|
kt->sec = ts.tv_sec;
|
|
kt->nsec = ts.tv_nsec;
|
|
}
|
|
|
|
static inline void pps_get_ts(struct pps_event_time *ts)
|
|
{
|
|
struct system_time_snapshot snap;
|
|
|
|
ktime_get_snapshot(&snap);
|
|
ts->ts_real = ktime_to_timespec64(snap.real);
|
|
#ifdef CONFIG_NTP_PPS
|
|
ts->ts_raw = ktime_to_timespec64(snap.raw);
|
|
#endif
|
|
}
|
|
|
|
/* Subtract known time delay from PPS event time(s) */
|
|
static inline void pps_sub_ts(struct pps_event_time *ts, struct timespec64 delta)
|
|
{
|
|
ts->ts_real = timespec64_sub(ts->ts_real, delta);
|
|
#ifdef CONFIG_NTP_PPS
|
|
ts->ts_raw = timespec64_sub(ts->ts_raw, delta);
|
|
#endif
|
|
}
|
|
|
|
#endif /* LINUX_PPS_KERNEL_H */
|