Commit ce3cc16a authored by Shin'ichiro Kawasaki's avatar Shin'ichiro Kawasaki Committed by Tirui Yin
Browse files

bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() 

mainline inclusion
from mainline-v5.19-rc3
commit 928ea982
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74W
CVE: CVE-2022-49711

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=928ea98252ad75118950941683893cf904541da9



--------------------------------

In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to
fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in
fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io
triggers KASAN use-after-free. To avoid the use-after-free, keep the
reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to
fsl_destroy_mc_io().

This patch needs rework to apply to kernels older than v5.15.

Fixes: f9362714 ("staging: fsl-mc: fix asymmetry in destroy of mc_io")
Cc: stable@vger.kernel.org # v5.15+
Signed-off-by: default avatarShin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarTirui Yin <yintirui@huawei.com>
Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
parent 3191c9e4

drivers/bus/fsl-mc/fsl-mc-bus.c

+3 −3
Original line number Diff line number Diff line
@@ -878,14 +878,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) 
static int fsl_mc_bus_remove(struct platform_device *pdev)

{

	struct fsl_mc *mc = platform_get_drvdata(pdev);

	struct fsl_mc_io *mc_io;



	if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))

		return -EINVAL;



	mc_io = mc->root_mc_bus_dev->mc_io;

	fsl_mc_device_remove(mc->root_mc_bus_dev);



	fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io);

	mc->root_mc_bus_dev->mc_io = NULL;

	fsl_destroy_mc_io(mc_io);



	return 0;

}