Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757294AbcJ3SAn (ORCPT ); Sun, 30 Oct 2016 14:00:43 -0400 Received: from thejh.net ([37.221.195.125]:54083 "EHLO thejh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753391AbcJ3SAk (ORCPT ); Sun, 30 Oct 2016 14:00:40 -0400 Date: Sun, 30 Oct 2016 19:00:36 +0100 From: Jann Horn To: Sudip Mukherjee Cc: Arnd Bergmann , Greg Kroah-Hartman , linux-kernel@vger.kernel.org, linux-parport@lists.infradead.org, Andy Lutomirski Subject: Re: [PATCH] ppdev: fix double-free of pp->pdev->name Message-ID: <20161030180036.GC2558@pc.thejh.net> References: <1477842248-2234-1-git-send-email-jann@thejh.net> <581633D3.3080502@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="adJ1OR3c6QgCpb/j" Content-Disposition: inline In-Reply-To: <581633D3.3080502@gmail.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2830 Lines: 70 --adJ1OR3c6QgCpb/j Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Oct 30, 2016 at 11:24:27PM +0530, Sudip Mukherjee wrote: > On Sunday 30 October 2016 09:14 PM, Jann Horn wrote: > >free_pardevice() is called by parport_unregister_device() and already fr= ees > >pp->pdev->name, don't try to do it again. > > > >This bug causes kernel crashes. > > > >I found and verified this with KASAN and some added pr_emerg()s: > > > >[ 60.316568] pp_release: pp->pdev->name =3D=3D ffff88039cb264c0 > >[ 60.316692] free_pardevice: freeing par_dev->name at ffff88039cb264c0 > >[ 60.316706] pp_release: kfree(ffff88039cb264c0) > >[ 60.316714] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > >[ 60.316722] BUG: Double free or freeing an invalid pointer > >[ 60.316731] Unexpected shadow byte: 0xFB > >[ 60.316801] Object at ffff88039cb264c0, in cache kmalloc-32 size: 32 > >[ 60.316813] Allocated: > >[ 60.316824] PID =3D 1695 > >[ 60.316869] Freed: > >[ 60.316880] PID =3D 1695 > >[ 60.316935] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > >CCing Andy Lutomirski because I think this is what broke vmapped stacks > >for me - after applying this patch, vmapped stacks worked for me. > >Previously, I got oopses (and lockups) caused by area->pages[0] being > >0x400000000 in __vunmap(), with area->pages being allocated in the kmall= oc > >area. >=20 > I think the above should not be a part of the commit message. Ah, yes. @maintainers: Feel free to remove that from the commit message. Or should I resend? --adJ1OR3c6QgCpb/j Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJYFjVEAAoJED4KNFJOeCOoycEQAJ8K982AqNTDt7lHukO+cKr/ XI/uhVsLcQZDGrP18nH38dZqAKOpgrN7E1maaAbOJ+h2TAxwRDH9d0hsrP27Oly6 lRQRHf/unzDUpDhbOP3aB9UsoRWmfwszIALJfmzB96nGsVuuf/7xPDMVqQkql5OC mGRceOWwyrCMFZqxmhLxhxnSMmS2exRYPEP0/HOyRlSOBjl5YN8bCnsSAdbKHdCj XKKxqtz8zJ2mS1SLTPPO3wxEekHGhGgG9rgMCu99NEgFPvy8uc2rSjGWVYXMXVpd uGZBjs2DMx/94wrvQkKTQtvmc6DJICNMdbQ1OjEgxojheLPeXxT/5TXv/RGHD316 +iip8CxPpoiWtOodrj4LN0iMTiSisdX4WZfmJlO6HIg+Z++PKMznamBetl71yj9/ LyqN4h+QB7HahGRCxCTpAAwiCO74GJgN8U1F4sQ0C32OKSjEb1W92O0wovZ4ITJc 2MVV6oRrkJ33MSC4pQhen+O+AtbJBLbWtwNPG0X0yrd0WHl1HIvvoM6VLCerJT/i qiWbgivRiSDcAbLoxL8B0MyKe5iDm6ssZXVlrM5+7eU9L2evg7RniTDZCYIJRsUR 3+2Pxsgpvb3MtYE5Af7+YtE8+5uakzUP9ZaRqKD+TPPI/hNFAgLRoUxzSe3A6GAN rTwMEh/I9StVK42SaJRg =4j9Z -----END PGP SIGNATURE----- --adJ1OR3c6QgCpb/j--