Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
IronPort-SDR: tyMVNQjmK3Vtit8V0UdXMP6cDgDMLMQGZouDmxuQWnoRXSnYY0OtdI5czMq7aZaC9zEb1IXC5S
 FLg9/EHRAT6G/KchQx+6QLZFUnKwz2+M8KTOZt6XLD86FQuWaccNh/JnGcQJr8a/eQxP+nXiR3
 VQj5tzN0cxNt2ABdKNPw25ZtLJM8fwWkFWA1fxfW34M75/6tfDLUc+xiFQGuJNNvcrvyIYlIGu
 cl9qcyc3q73kQP4GW251DoLzj7VZ19Ghx0MRmLWuTzASiO19ByjJ1F1KOhLI0+c7OW/7g1ECCD
 8yxVCQJVzrzrHqjgblrT+D5t
IronPort-SDR: Bvk7ynEZfxOpD+C1e+5kNvmxDSuzV+H5vpQmDoKnZQIm4K57i+QicNDXaebGkaxFxKoQXybAAC
 rhZv01fdsvG+ozFnR8a9lBSwjTfYTqgXoAcyHZfRMgXfCwY7QEnRkZWipFMGDASNINJdgP6af3
 +awhHemsIvOnwh6Te7Cz39aUnxCJPWI8dIUN/D6XPK9IH3b39P11gkqW1lf1QeG5jNHeG2ZT7s
 HUEeTZ3J4qBNyb8Hzt6l0ckPoH47iRpKeD1atdDAmDwsYcbPBOUeSOA5Yvtw8qnE2DwQRdj9Mj
 Vdk=
WDCIronportException: Internal
From:   Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
To:     linux-kernel@vger.kernel.org, Stuart Yoder <stuyoder@gmail.com>,
        Laurentiu Tudor <laurentiu.tudor@nxp.com>
Cc:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Bharat Bhushan <Bharat.Bhushan@nxp.com>,
        Damien Le Moal <damien.lemoal@opensource.wdc.com>,
        Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Subject: [PATCH] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
Date:   Wed,  1 Jun 2022 19:51:59 +0900
Message-Id: <20220601105159.87752-1-shinichiro.kawasaki@wdc.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to
fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in
fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io
triggers KASAN use-after-free. To avoid the use-after-free, keep the
reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to
fsl_destroy_mc_io().

This patch needs rework to apply to kernels older than v5.15.

Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io")
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Cc: stable@vger.kernel.org # v5.15+
---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 8fd4a356a86e..74593a1722fe 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1236,14 +1236,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 static int fsl_mc_bus_remove(struct platform_device *pdev)
 {
 	struct fsl_mc *mc = platform_get_drvdata(pdev);
+	struct fsl_mc_io *mc_io;
 
 	if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))
 		return -EINVAL;
 
+	mc_io = mc->root_mc_bus_dev->mc_io;
 	fsl_mc_device_remove(mc->root_mc_bus_dev);
-
-	fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io);
-	mc->root_mc_bus_dev->mc_io = NULL;
+	fsl_destroy_mc_io(mc_io);
 
 	bus_unregister_notifier(&fsl_mc_bus_type, &fsl_mc_nb);
 
-- 
2.35.3