kernel_optimize_test/drivers
Muchun Song ac43432cb1 driver core: Fix use-after-free and double free on glue directory
There is a race condition between removing glue directory and adding a new
device under the glue dir. It can be reproduced in following test:

CPU1:                                         CPU2:

device_add()
  get_device_parent()
    class_dir_create_and_add()
      kobject_add_internal()
        create_dir()    // create glue_dir

                                              device_add()
                                                get_device_parent()
                                                  kobject_get() // get glue_dir

device_del()
  cleanup_glue_dir()
    kobject_del(glue_dir)

                                                kobject_add()
                                                  kobject_add_internal()
                                                    create_dir() // in glue_dir
                                                      sysfs_create_dir_ns()
                                                        kernfs_create_dir_ns(sd)

      sysfs_remove_dir() // glue_dir->sd=NULL
      sysfs_put()        // free glue_dir->sd

                                                          // sd is freed
                                                          kernfs_new_node(sd)
                                                            kernfs_get(glue_dir)
                                                            kernfs_add_one()
                                                            kernfs_put()

Before CPU1 remove last child device under glue dir, if CPU2 add a new
device under glue dir, the glue_dir kobject reference count will be
increase to 2 via kobject_get() in get_device_parent(). And CPU2 has
been called kernfs_create_dir_ns(), but not call kernfs_new_node().
Meanwhile, CPU1 call sysfs_remove_dir() and sysfs_put(). This result in
glue_dir->sd is freed and it's reference count will be 0. Then CPU2 call
kernfs_get(glue_dir) will trigger a warning in kernfs_get() and increase
it's reference count to 1. Because glue_dir->sd is freed by CPU1, the next
call kernfs_add_one() by CPU2 will fail(This is also use-after-free)
and call kernfs_put() to decrease reference count. Because the reference
count is decremented to 0, it will also call kmem_cache_free() to free
the glue_dir->sd again. This will result in double free.

In order to avoid this happening, we also should make sure that kernfs_node
for glue_dir is released in CPU1 only when refcount for glue_dir kobj is
1 to fix this race.

The following calltrace is captured in kernel 4.14 with the following patch
applied:

commit 726e410979 ("drivers: core: Remove glue dirs from sysfs earlier")

--------------------------------------------------------------------------
[    3.633703] WARNING: CPU: 4 PID: 513 at .../fs/kernfs/dir.c:494
                Here is WARN_ON(!atomic_read(&kn->count) in kernfs_get().
....
[    3.633986] Call trace:
[    3.633991]  kernfs_create_dir_ns+0xa8/0xb0
[    3.633994]  sysfs_create_dir_ns+0x54/0xe8
[    3.634001]  kobject_add_internal+0x22c/0x3f0
[    3.634005]  kobject_add+0xe4/0x118
[    3.634011]  device_add+0x200/0x870
[    3.634017]  _request_firmware+0x958/0xc38
[    3.634020]  request_firmware_into_buf+0x4c/0x70
....
[    3.634064] kernel BUG at .../mm/slub.c:294!
                Here is BUG_ON(object == fp) in set_freepointer().
....
[    3.634346] Call trace:
[    3.634351]  kmem_cache_free+0x504/0x6b8
[    3.634355]  kernfs_put+0x14c/0x1d8
[    3.634359]  kernfs_create_dir_ns+0x88/0xb0
[    3.634362]  sysfs_create_dir_ns+0x54/0xe8
[    3.634366]  kobject_add_internal+0x22c/0x3f0
[    3.634370]  kobject_add+0xe4/0x118
[    3.634374]  device_add+0x200/0x870
[    3.634378]  _request_firmware+0x958/0xc38
[    3.634381]  request_firmware_into_buf+0x4c/0x70
--------------------------------------------------------------------------

Fixes: 726e410979 ("drivers: core: Remove glue dirs from sysfs earlier")
Signed-off-by: Muchun Song <smuchun@gmail.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Prateek Sood <prsood@codeaurora.org>
Link: https://lore.kernel.org/r/20190727032122.24639-1-smuchun@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-30 18:44:47 +02:00
..
accessibility
acpi Merge branch 'akpm' (patches from Andrew) 2019-07-19 09:45:58 -07:00
amba Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
android
ata for-5.3/libata-20190708 2019-07-09 10:59:26 -07:00
atm atm: idt77252: Remove call to memset after dma_alloc_coherent 2019-07-15 11:06:27 -07:00
auxdisplay It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
base driver core: Fix use-after-free and double free on glue directory 2019-07-30 18:44:47 +02:00
bcma
block Lots of exciting things this time! 2019-07-18 11:05:25 -07:00
bluetooth Bluetooth: btusb: Add protocol support for MediaTek MT7663U USB devices 2019-07-06 21:44:25 +02:00
bus ARM: SoC-related driver updates 2019-07-19 17:13:56 -07:00
cdrom
char docs: admin-guide: add a series of orphaned documents 2019-07-15 11:03:02 -03:00
clk This round of clk driver and framework updates is heavy on the driver update 2019-07-17 10:07:48 -07:00
clocksource clocksource/drivers/npcm: Fix misuse of GENMASK macro 2019-07-10 11:05:26 +02:00
connector
counter Staging / IIO driver update for 5.3-rc1 2019-07-11 15:36:02 -07:00
cpufreq Merge branch 'pm-cpufreq' 2019-07-18 09:49:30 +02:00
cpuidle Merge branch 'pm-cpufreq' 2019-07-18 09:49:30 +02:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-19 12:23:37 -07:00
dax Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
dca
devfreq
dio
dma dmaengine updates for v5.3-rc1 2019-07-17 09:55:43 -07:00
dma-buf Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
edac
eisa
extcon
firewire
firmware ARM: SoC-related driver updates 2019-07-19 17:13:56 -07:00
fpga mm: add account_locked_vm utility function 2019-07-16 19:23:25 -07:00
fsi
gnss
gpio GPIO fixes for the v5.3 merge window: 2019-07-17 13:05:21 -07:00
gpu drm fixes for -rc1: 2019-07-19 12:29:43 -07:00
hid Linux 5.2 2019-07-15 09:42:32 -07:00
hsi
hv proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
hwmon ARM: SoC-related driver updates 2019-07-19 17:13:56 -07:00
hwspinlock
hwtracing coresight: Make the coresight_device_fwnode_match declaration's fwnode parameter const 2019-07-12 14:42:05 -07:00
i2c Merge branch 'i2c/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2019-07-15 21:10:39 -07:00
i3c * Drop support for 10-bit I2C addresses 2019-07-09 09:04:31 -07:00
ide It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
idle
iio Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
infiniband SCSI fixes on 20190720 2019-07-20 10:04:58 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2019-07-20 12:22:30 -07:00
interconnect
iommu iommu/amd: fix a crash in iova_magazine_free_pfns 2019-07-21 09:57:13 -07:00
ipack TTY / Serial driver updates for 5.3-rc1 2019-07-11 15:38:21 -07:00
irqchip irqchip/gic-v3-its: Fix misuse of GENMASK macro 2019-07-10 11:04:17 +02:00
isdn ISDN: hfcsusb: checking idx of ep configuration 2019-07-15 11:10:31 -07:00
leds LED updates for 5.3-rc1 2019-07-09 08:59:39 -07:00
lightnvm
macintosh powerpc updates for 5.3 2019-07-13 16:08:36 -07:00
mailbox - stm32: race fix by adding a spinlock 2019-07-14 16:36:51 -07:00
mcb
md - Fix zone state management race in DM zoned target by eliminating 2019-07-18 14:49:33 -07:00
media Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2019-07-11 10:55:49 -07:00
memory Kbuild updates for v5.3 (2nd) 2019-07-20 09:34:55 -07:00
memstick MMC core: 2019-07-11 18:11:21 -07:00
message SCSI misc on 20190709 2019-07-11 15:14:01 -07:00
mfd - Core Frameworks 2019-07-15 20:18:40 -07:00
misc Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
mmc MMC core: 2019-07-11 18:11:21 -07:00
mtd docs: mtd: move it to the driver-api book 2019-07-15 09:20:28 -03:00
mux
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-07-19 10:06:06 -07:00
nfc
ntb New feature to add support for NTB virtual MSI interrupts, the ability 2019-07-21 09:46:59 -07:00
nubus
nvdimm Merge branch 'akpm' (patches from Andrew) 2019-07-19 09:45:58 -07:00
nvme for-linus-20190715 2019-07-15 21:20:52 -07:00
nvmem Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
of virtio, vhost: fixes, features, performance 2019-07-17 11:26:09 -07:00
opp pci-v5.3-changes 2019-07-15 20:44:49 -07:00
oprofile vfs: Convert oprofilefs to use the new mount API 2019-07-04 22:01:59 -04:00
parisc
parport It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
pci New feature to add support for NTB virtual MSI interrupts, the ability 2019-07-21 09:46:59 -07:00
pcmcia It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
perf docs: perf: move to the admin-guide 2019-07-15 09:20:27 -03:00
phy
pinctrl This is the bulk of pin control changes for the v5.3 kernel 2019-07-13 15:02:27 -07:00
platform platform/x86: asus: Rename "fan mode" to "fan boost mode" 2019-07-17 19:07:58 +03:00
pnp docs: driver-api: add a series of orphaned documents 2019-07-15 11:03:02 -03:00
power power supply and reset changes for the v5.3 series 2019-07-15 21:06:15 -07:00
powercap powercap/rapl: Add Ice Lake NNPI support to RAPL driver 2019-07-11 15:08:58 +02:00
pps drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl 2019-07-16 19:23:24 -07:00
ps3
ptp
pwm pwm: Changes for v5.3-rc1 2019-07-09 08:57:45 -07:00
rapidio Merge branch 'akpm' (patches from Andrew) 2019-07-17 08:58:04 -07:00
ras
regulator - Core Frameworks 2019-07-15 20:18:40 -07:00
remoteproc remoteproc updates for v5.3 2019-07-17 11:44:41 -07:00
reset ARM: SoC-related driver updates 2019-07-19 17:13:56 -07:00
rpmsg
rtc RTC for 5.3 2019-07-17 10:03:50 -07:00
s390 SCSI fixes on 20190720 2019-07-20 10:04:58 -07:00
sbus
scsi SCSI fixes on 20190720 2019-07-20 10:04:58 -07:00
sfi
sh
siox
slimbus
sn
soc ARM: Device-tree updates 2019-07-19 17:19:24 -07:00
soundwire soundwire updates for v5.3-rc1 2019-07-05 08:15:08 +02:00
spi Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
spmi
ssb
staging docs conversion for v5.3-rc1 2019-07-16 12:21:41 -07:00
target SCSI misc on 20190709 2019-07-11 15:14:01 -07:00
tc
tee
thermal More power management updates for 5.3-rc1 2019-07-18 09:32:28 -07:00
thunderbolt Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
tty ARM: SoC platform updates 2019-07-19 17:05:08 -07:00
uio
usb Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
uwb
vfio VFIO updates for v5.3-rc1 2019-07-17 11:23:13 -07:00
vhost virtio, vhost: fixes, features, performance 2019-07-17 11:26:09 -07:00
video - New Functionality 2019-07-16 09:25:04 -07:00
virt
virtio Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
visorbus
vlynq
vme
w1 docs: driver-api: add a series of orphaned documents 2019-07-15 11:03:02 -03:00
watchdog watchdog: digicolor_wdt: Remove unused variable in dc_wdt_probe 2019-07-15 08:49:11 +02:00
xen xen: fixes and features for 5.3-rc1 2019-07-19 11:41:26 -07:00
zorro
Kconfig
Makefile