mirror of
https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git
synced 2026-09-09 00:07:04 +08:00
Michal Schmidt
eeaeb168c0
JIRA: https://issues.redhat.com/browse/RHEL-77270 commit c79a39dc8d060b9e64e8b0fa9d245d44befeefbe Author: Calvin Owens <calvin@wbinvd.org> Date: Mon Nov 11 20:13:29 2024 -0800 pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]------------ kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called. WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150 CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1 Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kobject_put+0x120/0x150 lr : kobject_put+0x120/0x150 sp : ffffffc0803d3ae0 x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001 x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440 x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600 x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20 x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: kobject_put+0x120/0x150 cdev_put+0x20/0x3c __fput+0x2c4/0x2d8 ____fput+0x1c/0x38 task_work_run+0x70/0xfc do_exit+0x2a0/0x924 do_group_exit+0x34/0x90 get_signal+0x7fc/0x8c0 do_signal+0x128/0x13b4 do_notify_resume+0xdc/0x160 el0_svc+0xd4/0xf8 el0t_64_sync_handler+0x140/0x14c el0t_64_sync+0x190/0x194 ---[ end trace 0000000000000000 ]--- ...followed by more symptoms of corruption, with similar stacks: refcount_t: underflow; use-after-free. kernel BUG at lib/list_debug.c:62! Kernel panic - not syncing: Oops - BUG: Fatal exception This happens because pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(), but, as the comment above cdev_del() notes, fops for previously opened cdevs are still callable even after cdev_del() returns. I think this bug has always been there: I can't explain why it suddenly started happening every time I reboot this particular board. In commitd953e0e837("pps: Fix a use-after free bug when unregistering a source."), George Spelvin suggested removing the embedded cdev. That seems like the simplest way to fix this, so I've implemented his suggestion, using __register_chrdev() with pps_idr becoming the source of truth for which minor corresponds to which device. But now that pps_idr defines userspace visibility instead of cdev_add(), we need to be sure the pps->dev refcount can't reach zero while userspace can still find it again. So, the idr_remove() call moves to pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev. pps_core: source serial1 got cdev (251:1) <...> pps pps1: removed pps_core: unregistering pps1 pps_core: deallocating pps1 Fixes:d953e0e837("pps: Fix a use-after free bug when unregistering a source.") Cc: stable@vger.kernel.org Signed-off-by: Calvin Owens <calvin@wbinvd.org> Reviewed-by: Michal Schmidt <mschmidt@redhat.com> Link: https://lore.kernel.org/r/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
120 lines
2.9 KiB
C
120 lines
2.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* PPS API kernel header
|
|
*
|
|
* Copyright (C) 2009 Rodolfo Giometti <giometti@linux.it>
|
|
*/
|
|
|
|
#ifndef LINUX_PPS_KERNEL_H
|
|
#define LINUX_PPS_KERNEL_H
|
|
|
|
#include <linux/pps.h>
|
|
#include <linux/cdev.h>
|
|
#include <linux/device.h>
|
|
#include <linux/time.h>
|
|
|
|
/*
|
|
* Global defines
|
|
*/
|
|
|
|
struct pps_device;
|
|
|
|
/* The specific PPS source info */
|
|
struct pps_source_info {
|
|
char name[PPS_MAX_NAME_LEN]; /* symbolic name */
|
|
char path[PPS_MAX_NAME_LEN]; /* path of connected device */
|
|
int mode; /* PPS allowed mode */
|
|
|
|
void (*echo)(struct pps_device *pps,
|
|
int event, void *data); /* PPS echo function */
|
|
|
|
struct module *owner;
|
|
struct device *dev; /* Parent device for device_create */
|
|
};
|
|
|
|
struct pps_event_time {
|
|
#ifdef CONFIG_NTP_PPS
|
|
struct timespec64 ts_raw;
|
|
#endif /* CONFIG_NTP_PPS */
|
|
struct timespec64 ts_real;
|
|
};
|
|
|
|
/* The main struct */
|
|
struct pps_device {
|
|
struct pps_source_info info; /* PSS source info */
|
|
|
|
struct pps_kparams params; /* PPS current params */
|
|
|
|
__u32 assert_sequence; /* PPS assert event seq # */
|
|
__u32 clear_sequence; /* PPS clear event seq # */
|
|
struct pps_ktime assert_tu;
|
|
struct pps_ktime clear_tu;
|
|
int current_mode; /* PPS mode at event time */
|
|
|
|
unsigned int last_ev; /* last PPS event id */
|
|
wait_queue_head_t queue; /* PPS event queue */
|
|
|
|
unsigned int id; /* PPS source unique ID */
|
|
void const *lookup_cookie; /* For pps_lookup_dev() only */
|
|
struct device dev;
|
|
struct fasync_struct *async_queue; /* fasync method */
|
|
spinlock_t lock;
|
|
};
|
|
|
|
/*
|
|
* Global variables
|
|
*/
|
|
|
|
extern const struct attribute_group *pps_groups[];
|
|
|
|
/*
|
|
* Internal functions.
|
|
*
|
|
* These are not actually part of the exported API, but this is a
|
|
* convenient header file to put them in.
|
|
*/
|
|
|
|
extern int pps_register_cdev(struct pps_device *pps);
|
|
extern void pps_unregister_cdev(struct pps_device *pps);
|
|
|
|
/*
|
|
* Exported functions
|
|
*/
|
|
|
|
extern struct pps_device *pps_register_source(
|
|
struct pps_source_info *info, int default_params);
|
|
extern void pps_unregister_source(struct pps_device *pps);
|
|
extern void pps_event(struct pps_device *pps,
|
|
struct pps_event_time *ts, int event, void *data);
|
|
/* Look up a pps_device by magic cookie */
|
|
struct pps_device *pps_lookup_dev(void const *cookie);
|
|
|
|
static inline void timespec_to_pps_ktime(struct pps_ktime *kt,
|
|
struct timespec64 ts)
|
|
{
|
|
kt->sec = ts.tv_sec;
|
|
kt->nsec = ts.tv_nsec;
|
|
}
|
|
|
|
static inline void pps_get_ts(struct pps_event_time *ts)
|
|
{
|
|
struct system_time_snapshot snap;
|
|
|
|
ktime_get_snapshot(&snap);
|
|
ts->ts_real = ktime_to_timespec64(snap.real);
|
|
#ifdef CONFIG_NTP_PPS
|
|
ts->ts_raw = ktime_to_timespec64(snap.raw);
|
|
#endif
|
|
}
|
|
|
|
/* Subtract known time delay from PPS event time(s) */
|
|
static inline void pps_sub_ts(struct pps_event_time *ts, struct timespec64 delta)
|
|
{
|
|
ts->ts_real = timespec64_sub(ts->ts_real, delta);
|
|
#ifdef CONFIG_NTP_PPS
|
|
ts->ts_raw = timespec64_sub(ts->ts_raw, delta);
|
|
#endif
|
|
}
|
|
|
|
#endif /* LINUX_PPS_KERNEL_H */
|