From patchwork Fri Dec 10 16:09:51 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Whitchurch X-Patchwork-Id: 1566566 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=axis.com header.i=@axis.com header.a=rsa-sha256 header.s=axis-central1 header.b=VuLhHpVt; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=linux-rtc-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by bilbo.ozlabs.org (Postfix) with ESMTP id 4J9bTJ0WK2z9s1l for ; Sat, 11 Dec 2021 03:09:56 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240085AbhLJQN3 (ORCPT ); Fri, 10 Dec 2021 11:13:29 -0500 Received: from smtp1.axis.com ([195.60.68.17]:18344 "EHLO smtp1.axis.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238157AbhLJQN3 (ORCPT ); Fri, 10 Dec 2021 11:13:29 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axis.com; q=dns/txt; s=axis-central1; t=1639152594; x=1670688594; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=FYBGOA6sC3CRc57FcHrATP9TifdTUJPqbaBfTOEGkCg=; b=VuLhHpVtT9vldkLROxn6akUlTPZN7Ua3gMOni8dfBh8gRPFKHVPj6zh3 Pq30hKtAZ1W0GqTurq1QH3+AsArezPhWOtVQ792KRe6jLTARfaaYwAL9d IuPtJrDPbkQHOQu43jiw9jBDxEl1FlMz8z8cRpMbcHJ364oqxmp5Fps5l uo1WhEnuSKVgUf57IirPQQ6AKd0jWYcNwOrVL97Gk0xVtnl199EZQBJW/ WUZIwOS+lMS5bz8IHDE2IRiZ3vFnbb26S0OfaC5z3R+NYOhWUItJsswbS K2IiDlnJJJuCXnuIZINn5kcVwGmmdSe0aNrb+MTAwlhR01yn1YCX2WV6b w==; From: Vincent Whitchurch To: Alessandro Zummo , Alexandre Belloni CC: , Vincent Whitchurch , , Subject: [PATCH] rtc: fix use-after-free on device removal Date: Fri, 10 Dec 2021 17:09:51 +0100 Message-ID: <20211210160951.7718-1-vincent.whitchurch@axis.com> X-Mailer: git-send-email 2.33.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-rtc@vger.kernel.org If the irqwork is still scheduled or running while the RTC device is removed, a use-after-free occurs in rtc_timer_do_work(). Cleanup the timerqueue and ensure the work is stopped to fix this. BUG: KASAN: use-after-free in mutex_lock+0x94/0x110 Write of size 8 at addr ffffff801d846338 by task kworker/3:1/41 Workqueue: events rtc_timer_do_work Call trace: mutex_lock+0x94/0x110 rtc_timer_do_work+0xec/0x630 process_one_work+0x5fc/0x1344 ... Allocated by task 551: kmem_cache_alloc_trace+0x384/0x6e0 devm_rtc_allocate_device+0xf0/0x574 devm_rtc_device_register+0x2c/0x12c ... Freed by task 572: kfree+0x114/0x4d0 rtc_device_release+0x64/0x80 device_release+0x8c/0x1f4 kobject_put+0x1c4/0x4b0 put_device+0x20/0x30 devm_rtc_release_device+0x1c/0x30 devm_action_release+0x54/0x90 release_nodes+0x124/0x310 devres_release_group+0x170/0x240 i2c_device_remove+0xd8/0x314 ... Last potentially related work creation: insert_work+0x5c/0x330 queue_work_on+0xcc/0x154 rtc_set_time+0x188/0x5bc rtc_dev_ioctl+0x2ac/0xbd0 ... Signed-off-by: Vincent Whitchurch --- drivers/rtc/class.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c index 4b460c61f1d8..40d504dac1a9 100644 --- a/drivers/rtc/class.c +++ b/drivers/rtc/class.c @@ -26,6 +26,15 @@ struct class *rtc_class; static void rtc_device_release(struct device *dev) { struct rtc_device *rtc = to_rtc_device(dev); + struct timerqueue_head *head = &rtc->timerqueue; + struct timerqueue_node *node; + + mutex_lock(&rtc->ops_lock); + while ((node = timerqueue_getnext(head))) + timerqueue_del(head, node); + mutex_unlock(&rtc->ops_lock); + + cancel_work_sync(&rtc->irqwork); ida_simple_remove(&rtc_ida, rtc->id); mutex_destroy(&rtc->ops_lock);