Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33;
From:   Qiuxu Zhuo <qiuxu.zhuo@intel.com>
To:     Borislav Petkov <bp@alien8.de>, Tony Luck <tony.luck@intel.com>
Cc:     Lili Li <lili.li@intel.com>, James Morse <james.morse@arm.com>,
        Mauro Carvalho Chehab <mchehab@kernel.org>,
        Robert Richter <rric@kernel.org>,
        Qiuxu Zhuo <qiuxu.zhuo@intel.com>, linux-edac@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH 2/3] EDAC/device: Fix potential slab-use-after-free
Date:   Sun,  8 Oct 2023 16:02:30 +0800
Message-Id: <20231008080231.51917-2-qiuxu.zhuo@intel.com>
In-Reply-To: <20231008080231.51917-1-qiuxu.zhuo@intel.com>
References: <20231008080231.51917-1-qiuxu.zhuo@intel.com>
Precedence: bulk

From: Lili Li <lili.li@intel.com>

If the EDAC driver invokes edac_device_alloc_ctl_info() with pvt_sz=0,
the EDAC driver itself may manage 'pvt_info' and the EDAC core shouldn't
kfree it when unloading the EDAC driver. Otherwise it may lead to a
slab-use-after-free bug. Fix the potential bug by adding a flag to indicate
whether 'pvt_info' is managed by the EDAC core. The EDAC core will only
kfree 'pvt_info' when the flag is set to true.

Fixes: 9fb9ce392aae ("EDAC/device: Get rid of the silly one-shot memory allocation in edac_device_alloc_ctl_info()")
Suggested-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Lili Li <lili.li@intel.com>
---
 drivers/edac/edac_device.c | 1 +
 drivers/edac/edac_device.h | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
index 0689e1510721..b990431df2eb 100644
--- a/drivers/edac/edac_device.c
+++ b/drivers/edac/edac_device.c
@@ -100,6 +100,7 @@ edac_device_alloc_ctl_info(unsigned pvt_sz, char *dev_name, unsigned nr_instance
 			goto free;
 
 		dev_ctl->pvt_info = pvt;
+		dev_ctl->pvt_managed_by_edac_core = true;
 	}
 
 	dev_ctl->dev_idx	= device_index;
diff --git a/drivers/edac/edac_device.h b/drivers/edac/edac_device.h
index 3f44e6b9d387..cc6a364a4b83 100644
--- a/drivers/edac/edac_device.h
+++ b/drivers/edac/edac_device.h
@@ -197,6 +197,11 @@ struct edac_device_ctl_info {
 	const char *dev_name;	/* pci/platform/etc... name */
 
 	void *pvt_info;		/* pointer to 'private driver' info */
+	/*
+	 * Indicate whether the resource pointed by pvt_info is managed by
+	 * the EDAC core.
+	 */
+	bool pvt_managed_by_edac_core;
 
 	unsigned long start_time;	/* edac_device load start time (jiffies) */
 
@@ -355,7 +360,8 @@ extern const char *edac_layer_name[];
 static inline void __edac_device_free_ctl_info(struct edac_device_ctl_info *ci)
 {
 	if (ci) {
-		kfree(ci->pvt_info);
+		if (ci->pvt_managed_by_edac_core)
+			kfree(ci->pvt_info);
 		kfree(ci->attribs);
 		kfree(ci->blocks);
 		kfree(ci->instances);
-- 
2.17.1