Received-SPF: pass (google.com: domain of linux-kernel+bounces-182224-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <09d934d5-b5a3-4a6d-a565-e3f70e7a9d55@oracle.com>
Date: Fri, 17 May 2024 20:14:46 +0530
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] platform/x86: ISST: fix use-after-free in
 tpmi_sst_dev_remove()
To: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>,
        Hans de Goede <hdegoede@redhat.com>,
        =?UTF-8?Q?Ilpo_J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>,
        Zhang Rui <rui.zhang@intel.com>, platform-driver-x86@vger.kernel.org,
        linux-kernel@vger.kernel.org
Cc: dan.carpenter@linaro.org, kernel-janitors@vger.kernel.org,
        error27@gmail.com
References: <20240514092656.3462832-1-harshit.m.mogalapalli@oracle.com>
 <48377484a8a9e479b301e9a9772653a3bc6ccf81.camel@linux.intel.com>
 <e2b386431754d70c6772abee099dce4acc1d4023.camel@linux.intel.com>
Content-Language: en-US
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
In-Reply-To: <e2b386431754d70c6772abee099dce4acc1d4023.camel@linux.intel.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?TnFEeWFGaUJPT2FxRHRrR2JHdzFkbVIzWU1NYmo1YmhFd25ib3JsYjk1QnlF?=
 =?utf-8?B?Z2NtYkMyMVhSNlUwWlpIQXVLRHNLcE5uTFhiQXZmdm5zc3B2UVAyZUllOXUw?=
 =?utf-8?B?YXh3emRYdXNET0hBVWNPZTNlTzduS3NObUFmb3ZhdTVTbXd1WnJxSGphSVpY?=
 =?utf-8?B?ck1ha09BeUYxTGtpQ0FUS2RrQjZHcEVTSG9rYmU0VHhEdDB4bFdQbmhZY0hE?=
 =?utf-8?B?NlkvNWMvUG90WS9ySGd5dHZTQ3RRWlBrMi81aFRkaXpNSlorR1hnSTFXOFR2?=
 =?utf-8?B?WVZGN1R1d0NTd3dqS2Z0SEdVVHNlNEtXbGMvL25BeEFJeVFkZ1JvaWJYZzY0?=
 =?utf-8?B?Rm1ldlpRZ01oRzhUN0JXalBIMUZacUxTc1kzTHJMbXdpSVF3RFhTMWFZbE5F?=
 =?utf-8?B?dS9FT3QxUlhZRGc0eXQxTFI0T0hudW9vSml0cUJ3UFR6bTZ4eStUQUxyT3l5?=
 =?utf-8?B?YzVpLzFkNFVvNGkvSFd3K2p1eXhIVjZQNS95STN2Y2h0NEx3TWtpRlNwTEVR?=
 =?utf-8?B?N3V0NjNvVElDaG5ObHNzTXRtcWM1U1ZEVVZpNnF0YjJnR2pmN0FEQmdwckY4?=
 =?utf-8?B?RStJUjVwajh4RFpEb0NhOWF6b3pQUUFyRHRiMlJDdzlzdUppU0Y0VEdpSWNu?=
 =?utf-8?B?ZDJsL2E0Z1FpZUJOT2NnTTZmTmM2eVpYR280bCtGbGg4aDJTZjJuaDl0ejJD?=
 =?utf-8?B?a05iNTg4U2Z2WUFRYXAyWGYrUnU5eHFZVG4rVVZGdDhtWEZEUkdCZnUzYTRv?=
 =?utf-8?B?NnpGTUhSUTZZREZMV1B3RHQ3TXMzKytHRXBqQjRXWEFPQS9PR0tDaXJZbXRS?=
 =?utf-8?B?ZG5GUWZGVGtSclpZa2VjRFgwWFBxSjJsSjlYekJIc1pwbXpxSnNvcHI0SjF5?=
 =?utf-8?B?OHFERTNtQ20zby9ueUVUQm9nKytoM3puN2JoWUJ0cVpQa2VxczdzYnduUWNw?=
 =?utf-8?B?MlltRUNxbXRsTGU4QVBNdVVsZUFPK0thOFVoNFNoN2N2Tjh1Sm5pTUo3cFZB?=
 =?utf-8?B?cjd3Rkd2cUtiVTFIQXJGOUpzeUdobk5hZHM0cGo1eGkwV3NMbW9uUlMvZnZX?=
 =?utf-8?B?SHY4M3R5R2kwdE5PL3R4MVNxT3FlVGJQNDR4eW52aGRSSVN6WVJ5OGFvZita?=
 =?utf-8?B?bVJHTjJVTTFBRzIzeU5sWGRuNklGNDhhYU5VRTUrNUN2dnhvOGd5UmtNTndE?=
 =?utf-8?B?cEo5QkZ5NXMyTHplT3RKUzBXUWZnaXo4anQ2WXZualVPNkxOY3NkWWY3VWIx?=
 =?utf-8?B?ODhIMDc1VkxUL2MyUmtaMDhUd2VLYjNhNVlXT0N4MDA2VHU4b0s1dXZwL1Qz?=
 =?utf-8?B?MllqY08ybGxjN2NYR1dSRFZKSWZIZ2dXMUR6ekx4S0MraDFyRTVNMHRma1Mv?=
 =?utf-8?B?T2Rkc1AxQ1NEeFBtR21xc2ZjZThtWVhJekltZkhWVFF4VWV1cGhhTU9SRU1L?=
 =?utf-8?B?ejNVZUh4dkNXeWUxY20wa1kzcmtCc2J5TlhrWDk5SXZKSG11QXNETC9OL2cz?=
 =?utf-8?B?T1JBb2doMDNUQVZvTHBVbGt0dFdVZS9HWjZ6b1JnYi92aSt0UnRmVVJDT3h5?=
 =?utf-8?B?ajJXbHJLRklCaUJ1RklsUXpjczFqTTEzeVVKdy9nTkpjN0hsKzVWS1FSY3I4?=
 =?utf-8?B?QTZKcjVBVC91eEpHQldQUUI1TUpqT0VTOU1DdnVod1BFV09MVjhEV1VZbmhy?=
 =?utf-8?B?cHk1Z0kxanVNRzVCUW56SVNvZUZDdlVVdWIxeHcxVzBmb1ErWU9idERRaWgy?=
 =?utf-8?B?a2s0RTJKRWkvOXNnSzFVenFHNEhnVkZFUlhCc1NTajR6aTZFOGRXZUdpWEZo?=
 =?utf-8?B?anV0Q2pRR3VDWGwxbnR0ODhSbVVUTDZVWEp5QmJrNnc1bEI3TlpBRU10MUp1?=
 =?utf-8?B?aytsYURROXVkZEFialFvVkwzK1pWNEVVRHdUblA1OGxrNTlIeVRGNy8yUjNM?=
 =?utf-8?B?ejZoeWFxTkhhRXpOY0N4ZGFlYVRZblNsYUVHQjhRVkhCbUFmNTZRekZkTE0w?=
 =?utf-8?B?V3hZdk9iUDZZSG9QVjcwOTFYYkZpR3YrQzNjcVVXRnRSdkI0NHhkeEloclpa?=
 =?utf-8?B?YmNPTXBlQkltWFBtNkRvZUdpYjNJa2FzNmVaSko3UVFzMUt1cy9zQ2N2YitJ?=
 =?utf-8?B?NFFxbmViZ1l4ZXVOM1ROcUpXaTNpc0hSeHNrbk9CbThXMVU2WEJDbFFEbEdC?=
 =?utf-8?Q?Fjr9MNv3oamDgEwlEntxSdw=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	vHlwasTEXPtHoh72zdnyLevaDPNEjZrx6UbGmUvoU6Mg+W1ll6ypvfpg8St+CvflekEfUvi/EVrMNPoLvprpdUKLUCNEpanL1miK6Fc6vIW76upK3IgS/lW9p7Yj28AoRfXadf2yy9wD797QdM7I0S/bzbMInW7JtWRR7DivDhOidi0aEhjRYoNEtxsyoQklruqm+RKcQCYJbJYeLtQoVuNzTlLcCoMVAknabRLPLoX4Ugn+gDpfZDh1oxtgGGEAd5jDjsI0tBo2asGql8k+kvNlUkleYRtCnto4tpmnvmPCk0in9J/9+XrXC+2wdsuTXQCIBDuP8NJPwOurdPtkz6+NxvfQ+Pytgjgam6+EKa8xTPEolQrvzyqAjFBFSfJgyJBCFwOALkRdaDite4LmUQOFU4Y3GtoQ1lGOqS36Jguz4bsEqfnV6KqondZrlwqWyvuyA8vyDxVK1ruXzAFh45MUQh4MbA4RK8kGo6FOybkC4uoMEsh9OUw45RWrtViX44tqyEV4YYD7k51C8SC58AdhpDm5fe+rNM50pPjQd2d5ugZgxtb9TXYn9FPWIo/Hj7PQ5/He7THv2kJhdSvF1lVXa5rQlWa/ydpceFBZ8ho=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 513f38e7-b95a-4750-fb96-08dc767feb1f
X-MS-Exchange-CrossTenant-AuthSource: PH8PR10MB6290.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 May 2024 14:44:56.0514
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5+roGuAWMzpnR6+6lnossWL02+l67bFZzDdrDaflQmVqJObVz5WhgVVjAsYGjfPDtB2HvxRa2vF7Mu6ZidVhsZgnTs0p/4YR3MDsvRg/NOMnKyDmzCX183PnJAa3J9bV
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB5749
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-17_06,2024-05-17_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 adultscore=0
 mlxlogscore=999 phishscore=0 malwarescore=0 suspectscore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2405010000 definitions=main-2405170116
X-Proofpoint-ORIG-GUID: MDuLQW2-q1EkUOvYX2BzOPrDslNPScNb
X-Proofpoint-GUID: MDuLQW2-q1EkUOvYX2BzOPrDslNPScNb

On 17/05/24 20:03, srinivas pandruvada wrote:
> On Fri, 2024-05-17 at 07:31 -0700, srinivas pandruvada wrote:
>> On Tue, 2024-05-14 at 02:26 -0700, Harshit Mogalapalli wrote:
>>> In tpmi_sst_dev_remove(), tpmi_sst is dereferenced after being
>>> freed.
>>> Fix this by reordering the kfree() post the dereference.
>>>
>>> Fixes: 9d1d36268f3d ("platform/x86: ISST: Support partitioned
>>> systems")
>>> Signed-off-by: Harshit Mogalapalli
>>> <harshit.m.mogalapalli@oracle.com>
>> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
>>
> I realized the line length is 127 chars in commit description.
> Please fix that and run checkpatch.pl before posting again.
> 

Thanks for the ACK.

Sorry I usually run checkpatch.pl, but somehow missed noticing the 
error. Will send it with the commit message fixup.

Thanks,
Harshit
> Thanks,
> Srinivas
> 
>>> ---
>>> This is found by smatch and only compile tested.
>>> ---
>>>   drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git
>>> a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
>>> b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
>>> index 7bac7841ff0a..7fa360073f6e 100644
>>> --- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
>>> +++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
>>> @@ -1610,8 +1610,8 @@ void tpmi_sst_dev_remove(struct
>>> auxiliary_device *auxdev)
>>>          tpmi_sst->partition_mask_current &= ~BIT(plat_info-
>>>> partition);
>>>          /* Free the package instance when the all partitions are
>>> removed */
>>>          if (!tpmi_sst->partition_mask_current) {
>>> -               kfree(tpmi_sst);
>>>                  isst_common.sst_inst[tpmi_sst->package_id] = NULL;
>>> +               kfree(tpmi_sst);
>>>          }
>>>          mutex_unlock(&isst_tpmi_dev_lock);
>>>   }
>>
>