| From f35aef728ba6afbb764b292918a104aad7d819ce Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 14 Sep 2021 16:56:23 +0000 |
| Subject: cpufreq: schedutil: Destroy mutex before kobject_put() frees the |
| memory |
| |
| From: James Morse <james.morse@arm.com> |
| |
| [ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ] |
| |
| Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() |
| method to free sugov_tunables") kobject_put() has kfree()d the |
| attr_set before gov_attr_set_put() returns. |
| |
| kobject_put() isn't the last user of attr_set in gov_attr_set_put(), |
| the subsequent mutex_destroy() triggers a use-after-free: |
| | BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60 |
| | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20 |
| | |
| | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369 |
| | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development |
| | Platform, BIOS EDK II Jul 30 2018 |
| | Call trace: |
| | dump_backtrace+0x0/0x380 |
| | show_stack+0x1c/0x30 |
| | dump_stack_lvl+0x8c/0xb8 |
| | print_address_description.constprop.0+0x74/0x2b8 |
| | kasan_report+0x1f4/0x210 |
| | kasan_check_range+0xfc/0x1a4 |
| | __kasan_check_read+0x38/0x60 |
| | mutex_is_locked+0x20/0x60 |
| | mutex_destroy+0x80/0x100 |
| | gov_attr_set_put+0xfc/0x150 |
| | sugov_exit+0x78/0x190 |
| | cpufreq_offline.isra.0+0x2c0/0x660 |
| | cpuhp_cpufreq_offline+0x14/0x24 |
| | cpuhp_invoke_callback+0x430/0x6d0 |
| | cpuhp_thread_fun+0x1b0/0x624 |
| | smpboot_thread_fn+0x5e0/0xa6c |
| | kthread+0x3a0/0x450 |
| | ret_from_fork+0x10/0x20 |
| |
| Swap the order of the calls. |
| |
| Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables") |
| Cc: 4.7+ <stable@vger.kernel.org> # 4.7+ |
| Signed-off-by: James Morse <james.morse@arm.com> |
| Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c |
| index 66b05a326910..a6f365b9cc1a 100644 |
| --- a/drivers/cpufreq/cpufreq_governor_attr_set.c |
| +++ b/drivers/cpufreq/cpufreq_governor_attr_set.c |
| @@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l |
| if (count) |
| return count; |
| |
| - kobject_put(&attr_set->kobj); |
| mutex_destroy(&attr_set->update_lock); |
| + kobject_put(&attr_set->kobj); |
| return 0; |
| } |
| EXPORT_SYMBOL_GPL(gov_attr_set_put); |
| -- |
| 2.33.0 |
| |