From patchwork Wed Jan 18 15:08:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manivannan Sadhasivam X-Patchwork-Id: 644233 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C848C677F1 for ; Wed, 18 Jan 2023 15:09:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231628AbjARPJq (ORCPT ); Wed, 18 Jan 2023 10:09:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41346 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231585AbjARPJb (ORCPT ); Wed, 18 Jan 2023 10:09:31 -0500 Received: from mail-pf1-x436.google.com (mail-pf1-x436.google.com [IPv6:2607:f8b0:4864:20::436]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 015C3233D9 for ; Wed, 18 Jan 2023 07:09:31 -0800 (PST) Received: by mail-pf1-x436.google.com with SMTP id 200so20238945pfx.7 for ; Wed, 18 Jan 2023 07:09:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9g1r2YkbrCTL06JBn8TcdxJnLCnZpZqC+qdq6jkkxOk=; b=rmGHhTlj8O6W1yPAhd3uk2Ho8WDQV2ls8DgNFrQvHO8xa5RrlA6ALv/tHMw3UtegjW uqKI8SSb5ozUimyYj7w3LSV61Kuk7og8suQrm1s2/uBYGWx1E8e8+UTZWwXFYUkb9eEL lo4+CJxoKxTh9NmrYfhJ8cQFpyT9/yvaUSXXInOg50ZEnzW3wCzXGWjkf/N2pSJxrcnx O2lXZ3BPh1lMOkLCDCqNEQTA5yPe7iKk5Q2QO7A1+syXPfPEX9xHDqByGpjF2QPNeACx NJKYI778puEQkLpRby0cQlida5hNSZRwwTyoxlUd4xBBmwuL+76wvu9c/ou2wdGNsAkc q7vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9g1r2YkbrCTL06JBn8TcdxJnLCnZpZqC+qdq6jkkxOk=; b=vAkHemEIKACB/i8c8ARa8XVpABYZpwjaqWbCi/GO68rDoRsXW/6sTl9RGxCq9c7IYE 2Mm+9REwX39R49V9lFnbkOs4ZznsTXML28LULdbV8qeOWzLxVi9rASgmHh2xMH+upxMp yO1/yWJT9pgJlg6ntLniLe6k6XS0/DCfDj0lTDpEQymMB53ARExlOrP/Uca+37z60+2R zIsoXuWrTCGQKg66e73frqgJQb7ZoKutxXgK+kp1kVW5xIl+I2P3WBhNzyE+CHGUA6Zm M028Kjd17RxCzvqtrYRPTkv3P5yIO1z5e+6Dbv6eG0CxOVlOy95M2t44pvObc4dLyfDK kmgg== X-Gm-Message-State: AFqh2kqlR9TQS475iwCk7oO/O7v1/yoiZ7SE5KJ4Rbz8odeVcOBEyWpS HtscZshj0Dvp+TiNMVn8xJ/B X-Google-Smtp-Source: AMrXdXvZOMcQB/ZBoqS+3k2rADk7d3DCLX6WFNCx/MxVUn82xQIrp1DOK76Vvu1vLwsXnqn861Rddg== X-Received: by 2002:aa7:9a50:0:b0:589:b85:1e32 with SMTP id x16-20020aa79a50000000b005890b851e32mr7763285pfj.16.1674054570482; Wed, 18 Jan 2023 07:09:30 -0800 (PST) Received: from localhost.localdomain ([27.111.75.61]) by smtp.gmail.com with ESMTPSA id i15-20020aa796ef000000b0058d9623e7f1sm6721544pfq.73.2023.01.18.07.09.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Jan 2023 07:09:29 -0800 (PST) From: Manivannan Sadhasivam To: andersson@kernel.org, robh+dt@kernel.org, krzysztof.kozlowski+dt@linaro.org, bp@alien8.de, tony.luck@intel.com Cc: quic_saipraka@quicinc.com, konrad.dybcio@linaro.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, james.morse@arm.com, mchehab@kernel.org, rric@kernel.org, linux-edac@vger.kernel.org, quic_ppareek@quicinc.com, luca.weiss@fairphone.com, ahalaney@redhat.com, steev@kali.org, Manivannan Sadhasivam , stable@vger.kernel.org Subject: [PATCH v6 03/17] EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info Date: Wed, 18 Jan 2023 20:38:50 +0530 Message-Id: <20230118150904.26913-4-manivannan.sadhasivam@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230118150904.26913-1-manivannan.sadhasivam@linaro.org> References: <20230118150904.26913-1-manivannan.sadhasivam@linaro.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org The memory for "llcc_driv_data" is allocated by the LLCC driver. But when it is passed as "pvt_info" to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass "llcc_driv_data" as pvt_info but rather reference it using the "platform_data" in the qcom_edac driver. Cc: # 4.20 Fixes: 27450653f1db ("drivers: edac: Add EDAC driver support for QCOM SoCs") Tested-by: Steev Klimaszewski # Thinkpad X13s Tested-by: Andrew Halaney # sa8540p-ride Reported-by: Steev Klimaszewski Reviewed-by: Borislav Petkov (AMD) Signed-off-by: Manivannan Sadhasivam --- drivers/edac/qcom_edac.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c index 9e77fa84e84f..3256254c3722 100644 --- a/drivers/edac/qcom_edac.c +++ b/drivers/edac/qcom_edac.c @@ -252,7 +252,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) static int dump_syn_reg(struct edac_device_ctl_info *edev_ctl, int err_type, u32 bank) { - struct llcc_drv_data *drv = edev_ctl->pvt_info; + struct llcc_drv_data *drv = edev_ctl->dev->platform_data; int ret; ret = dump_syn_reg_values(drv, bank, err_type); @@ -289,7 +289,7 @@ static irqreturn_t llcc_ecc_irq_handler(int irq, void *edev_ctl) { struct edac_device_ctl_info *edac_dev_ctl = edev_ctl; - struct llcc_drv_data *drv = edac_dev_ctl->pvt_info; + struct llcc_drv_data *drv = edac_dev_ctl->dev->platform_data; irqreturn_t irq_rc = IRQ_NONE; u32 drp_error, trp_error, i; int ret; @@ -358,7 +358,6 @@ static int qcom_llcc_edac_probe(struct platform_device *pdev) edev_ctl->dev_name = dev_name(dev); edev_ctl->ctl_name = "llcc"; edev_ctl->panic_on_ue = LLCC_ERP_PANIC_ON_UE; - edev_ctl->pvt_info = llcc_driv_data; rc = edac_device_add_device(edev_ctl); if (rc)