On Thu, Feb 06, 2020 at 05:26:21PM +1100, Oliver O'Halloran wrote:
> The cpufreq driver has a use-after-free that we can hit if:
>
> a) There's an OCC message pending when the notifier is registered, and
> b) The cpufreq driver fails to register with the core.
>
> When a) occurs the notifier schedules a workqueue item to handle the
> message. The backing work_struct is located on chips[].throttle and when b)
> happens we clean up by freeing the array. Once we get to the (now free)
> queued item and the kernel crashes.
>
> Cc: Vaidyanathan Srinivasan <sva...@linux.vnet.ibm.com>
> Fixes: c5e29ea ("cpufreq: powernv: Fix bugs in powernv_cpufreq_{init/exit}")
> Signed-off-by: Oliver O'Halloran <ooh...@gmail.com>
Thanks for this fix Oliver.
Reviewed-by: Gautham R. Shenoy <e...@linux.vnet.ibm.com>
> ---
> drivers/cpufreq/powernv-cpufreq.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/cpufreq/powernv-cpufreq.c
> b/drivers/cpufreq/powernv-cpufreq.c
> index 56f4bc0..1806b1d 100644
> --- a/drivers/cpufreq/powernv-cpufreq.c
> +++ b/drivers/cpufreq/powernv-cpufreq.c
> @@ -1080,6 +1080,12 @@ static int init_chip_info(void)
>
> static inline void clean_chip_info(void)
> {
> + int i;
> +
> + /* flush any pending work items */
> + if (chips)
> + for (i = 0; i < nr_chips; i++)
> + cancel_work_sync(&chips[i].throttle);
> kfree(chips);
> }
>
> --
> 2.9.5
>
