Received-SPF: pass (google.com: domain of linux-kernel+bounces-183418-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <056695ad-fbb8-4ca2-a1c6-07082af6fed7@oracle.com>
Date: Mon, 20 May 2024 10:53:35 +0530
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] platform/x86: ISST: fix use after free problem in
 tpmi_sst_dev_remove()
To: Su Hui <suhui@nfschina.com>, srinivas.pandruvada@linux.intel.com,
        hdegoede@redhat.com, ilpo.jarvinen@linux.intel.com, nathan@kernel.org,
        ndesaulniers@google.com, morbo@google.com, justinstitt@google.com
Cc: rui.zhang@intel.com, platform-driver-x86@vger.kernel.org,
        linux-kernel@vger.kernel.org, llvm@lists.linux.dev,
        kernel-janitors@vger.kernel.org
References: <20240520021934.113877-1-suhui@nfschina.com>
Content-Language: en-US
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
In-Reply-To: <20240520021934.113877-1-suhui@nfschina.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?K2ltY2w4cE0rTllzcGlkbHJxVGJmNmZ4NnJvZlI3NHZsMktYck1FcmZ5SG5E?=
 =?utf-8?B?dVhDbUFkMk1wZmMzUWJmYnV5Y3VzejBjd1dsbE9oNXlieDdxRTlnZ3p4cEVS?=
 =?utf-8?B?NlR0U0RUQVJDWHRjVGRaeTJrNStidHFhbUtES2dWWkU4WEJYWng4d2RnS0Vk?=
 =?utf-8?B?SFVzclRuWVM4RDUvSzEvUCtKUlUxKzJjODdjSVJNd1FDdVc2OWFHTmZMYzRl?=
 =?utf-8?B?Mm8yMmJocFBENDh2b1luK0tMQktueDlYRTB2TGQycUtyL0E1OWQ1NzVGUWNY?=
 =?utf-8?B?L2JEcXlYamVhQ1Myek0rb0ludlN6VXFpU3JFdFVXMnkvT2F4TkZVUUdNVndr?=
 =?utf-8?B?N0JhVlRqYUU1UEs1b1laWUlJbUhSV012RERnRVUxWGpvMzd4QXAwUVhSM09D?=
 =?utf-8?B?NEQ2clpEUVc1emNWSGJPVGd5dm9HMk1YMTZYWDNtT1dwMXBJeGVzYXUyR0Ex?=
 =?utf-8?B?U2dxMWNSRTNoSndFUGdjS2dFYysvSHNRMWdWaWRxeVA3T3hsaEVIWnJHTEZ1?=
 =?utf-8?B?MUViS280L2JIK0pYcmJLYmJPSGJoblNlTFhHMFkrc0kxeU1tdkY1K0FxS25O?=
 =?utf-8?B?SkpJVE83d0FvaHBLUnZGeFRleWFHS01Id0Nkd1cvdE1qNkl3eW1LZUpXbzE3?=
 =?utf-8?B?WnlHTVF5eXlidW9TTWpNT2dIZTV2K00yRmQ3SnpIWk56SSthMHFNUUp5UUdC?=
 =?utf-8?B?YURzMWYxcmxHS2lqUUpuOElXbDFLQmttZmlydlBOMy9tK25sN1BVWWFzNk9Z?=
 =?utf-8?B?cm9jb01HNVZWa2NMcjE5aHFNL3ZRUisxL3RwUkZoV09oLzNUeWVJRE1ubjA4?=
 =?utf-8?B?WFl5bWNTYXZsS3VFaUJvN3FoVWJZMnlUN2gwOHNEazhXZzlhcmhncmJzTEFm?=
 =?utf-8?B?WDcrWng0ZUF1OTUvRm04V2hMUXF5S1pTYnNWcjdoc1U1U2dtYlM3V2hUMmxp?=
 =?utf-8?B?OFlxSTA0YURtWExIMmpkT1ExZEllbTcvMXFiV2JZNkF5MVRFamQvb0NOVkd3?=
 =?utf-8?B?dWIyb0pRWlZZNGhrS2ZVN2dJS1BpRlpBQnAwaDUzazdVS3JEbzMyMytkbU9X?=
 =?utf-8?B?blpNekJSOFNHQUJPRXRYRHN0VXYzS2JQSGw5eFJOa2RwVjFJVWw5WUl4cGdi?=
 =?utf-8?B?bjBpL2EzT2xyT1ZodVI0RnJDSnFBaXhBZXFzanJ3RndBUTdPQVdaVys5TGJK?=
 =?utf-8?B?dUVzeG1mVjA1R0wyUFVkWEx1THVDaEpDanRjT0ZnR2VHYlhYL0JEdUFpdC9T?=
 =?utf-8?B?MUVWbXl6OVZwcFZQaGVpQy91ajdzNWMrRU1sU1czWkpKRHNGeU9UcG83c2tj?=
 =?utf-8?B?dUl5YzNPc0l2ZjY0YWlraklhSSt3Z2FXb25oRmd4Vmp6YkpabUY5bjU1K2JE?=
 =?utf-8?B?d05La1ByNjNEbVZIRmx2V1RCTFQ0d015NU81SDduK21URkp3blQrWStoUFg5?=
 =?utf-8?B?U1h3R2RMT1F1RTBiLzB3S0ZQWGU1WkxDYkYrcmtWRVVOLzBPMThlN1RFa3ZV?=
 =?utf-8?B?Uml1YjV1eUl2WXAzaFZHMW03ak4rM0ZiNmh6L0ZXaVRtNXR2cmswWmdLVFRr?=
 =?utf-8?B?a2NRNm5OZm9yTTZyR0hONkJVYWg2MTFNK0FNSldPTm83bHRGcTRVRXdGMUpj?=
 =?utf-8?B?a3VKcmM2LzVOYnNSUFFjYVRWMldHdUluN0dMOFYva2VLRDZoanZjMHNORUlY?=
 =?utf-8?B?TGhyUk1ScjQxYThXNUluYnoxblA1NkZzQ1p4M2ZZWE85SEpGNkUrcDVFd3gv?=
 =?utf-8?B?UlV2aElRbVhWcXhvZklpbEJDN2RQdEJVZGxyS0NOQ21qUjdHNjd3d0YzUTND?=
 =?utf-8?B?aTNnR2E3M2ZBTysxdFVobFNESFFVNGJSS29rd2cvaTFidWNxbmxjclJERDIr?=
 =?utf-8?B?SnJhUU9pU1llcXpTRjJTZFdNNk1pcXZWRGRxaFY4bHo4cWlUamtnL2ErQVZp?=
 =?utf-8?B?M1NVUXVXaUVYcEN4aEdITmJQZmV3Qk1uaDVuVm9KOTVSWlV5dVQzNjVKdXdq?=
 =?utf-8?B?aEJiL2tsclpkdFB0WS9hMVJXMkQrQ2E1cGVPY3Q1RE1idG03Y1YxdDRZUDF0?=
 =?utf-8?B?Unc2UDFpZmJQbjRtdHhMdDFHczJjMmZIWHlWNHRwUkVzVkZnYXlXdzdJYS9F?=
 =?utf-8?B?OHZpby96TVNFNEQwcmJlNnFVRjNVbVlwZEV6NHcwUktCR2kwVmEvYWp4Zzdk?=
 =?utf-8?Q?3hGOakAszqtxSz5f0YNTfLg=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	sw9WVfsjEhuAHs+LgrdC/Gei7r3gJJO/x0mXlmmpIZizxOS4ymrrMDFjcfGtrR8AU1DdjQhoxCfDdbmmY2k7BILvatspY6QBdb6pbROy2JM3QZvpLnWKqlXEOhMI7yXH3kA7fnZw5h97jvQ0GdB664vXIzLaXxrhvX9IAR/shrfhbLJmsXeyIoIwyi+eajCERnU/TgXZicsCowubhUH6B9JPSCFgPSbWXTLpvCz08PMz+KKLWesuEiym57HXHPnuHjmfLfznEoFCMOLNPDz5GS1DzCQqlWI1Ct+epf/kcEsRun8Nbix7Pcp0RaNKylQQB8jl8ppGhD0Q3GFrxumD3Hma/3TEIcFf1tcEqbMjIrr0+CndDHF604nEDt4Abv61a7np6Ru1tKHnpY76J+ta6UCmSZyFDU5E6IZ2mkOanMnnzc1UR+p1EgS2rE+YA9uiiGI2yPKoE1EPokGfaNBE3dIOCREgUDrfwmg3PVdf/UGfl4eItI1XnkL8a1or0mON67DZqZVfKWuYShxIXXFxTTtmjpWCHP+3d8LE8NVOBIQ12jfH1NrASt3pe91/Q0IbItbmlgSIGqsIe8Thrpr9Aym30b2uhxna7bSPunAcMuA=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6fee8b17-d1e8-4c69-b5e2-08dc788d046f
X-MS-Exchange-CrossTenant-AuthSource: PH8PR10MB6290.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 May 2024 05:23:44.2741
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: YfKq90UtudOx5EEA9xNoe3yhayRRmS2M8LQn5eK5qLCAjaKM/GLPnfCDxa2WyQwrok5jpq0XeYjtPOFxNdkrXxeD80omD5TtKhSVeQFD+HBx0hw6/TRo5JsuyH+miaW/
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6123
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-20_02,2024-05-17_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 phishscore=0
 suspectscore=0 mlxscore=0 adultscore=0 mlxlogscore=999 spamscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2405010000 definitions=main-2405200043
X-Proofpoint-GUID: w9YWtw7XTE5YleQBp5u-8iNz_VvTsKvy
X-Proofpoint-ORIG-GUID: w9YWtw7XTE5YleQBp5u-8iNz_VvTsKvy

Hi Su Hui,

On 20/05/24 07:49, Su Hui wrote:
> clang static checker (scan-build) warning:
> drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c:1614:24:
> Use of memory after it is freed.
> 
> Using 'tpmi_sst->package_id' after releasing 'tpmi_sst' causes this
> problem. Change the order of releasing 'tpmi_sst' to fix this.
> 

This is fixed by me already.
Ref: 
https://lore.kernel.org/all/9293c51c7d502843bfff90c5664be00bfe112e8d.camel@linux.intel.com/

Thanks,
Harshit
> Fixes: 9d1d36268f3d ("platform/x86: ISST: Support partitioned systems")
> Signed-off-by: Su Hui <suhui@nfschina.com>
> ---
>   drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> index 7bac7841ff0a..7fa360073f6e 100644
> --- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> +++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> @@ -1610,8 +1610,8 @@ void tpmi_sst_dev_remove(struct auxiliary_device *auxdev)
>   	tpmi_sst->partition_mask_current &= ~BIT(plat_info->partition);
>   	/* Free the package instance when the all partitions are removed */
>   	if (!tpmi_sst->partition_mask_current) {
> -		kfree(tpmi_sst);
>   		isst_common.sst_inst[tpmi_sst->package_id] = NULL;
> +		kfree(tpmi_sst);
>   	}
>   	mutex_unlock(&isst_tpmi_dev_lock);
>   }