From: Matthew Auld Date: Thu, 5 Oct 2023 16:38:55 +0000 (+0100) Subject: drm/xe/hwmon: fix uaf on unload X-Git-Tag: v6.8-rc1~111^2~7^2~318 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3a13c2de442d6bfaef9c102cd1092e6cae22b753;p=thirdparty%2Fkernel%2Flinux.git drm/xe/hwmon: fix uaf on unload It doesn't look like you can mix and match devm_ and drmmm_ for a managed resource. For drmmm the resources are all tracked in drm with its own list, and there is only one devm_ resource for the entire list. If the driver itself also adds some of its own devm resources, then those will be released first. In the case of hwmon the devm_kzalloc will be freed before the drmmm_ action to destroy the mutex allocated within, leading to uaf. Since hwmon itself wants to use devm, rather use that for the mutex destroy. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/766 Signed-off-by: Matthew Auld Cc: Badal Nilawar Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi --- diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c index 734fcca9f71fa..9ac05994a967d 100644 --- a/drivers/gpu/drm/xe/xe_hwmon.c +++ b/drivers/gpu/drm/xe/xe_hwmon.c @@ -585,6 +585,13 @@ xe_hwmon_get_preregistration_info(struct xe_device *xe) xe_hwmon_energy_get(hwmon, &energy); } +static void xe_hwmon_mutex_destroy(void *arg) +{ + struct xe_hwmon *hwmon = arg; + + mutex_destroy(&hwmon->hwmon_lock); +} + void xe_hwmon_register(struct xe_device *xe) { struct device *dev = xe->drm.dev; @@ -600,7 +607,9 @@ void xe_hwmon_register(struct xe_device *xe) xe->hwmon = hwmon; - drmm_mutex_init(&xe->drm, &hwmon->hwmon_lock); + mutex_init(&hwmon->hwmon_lock); + if (devm_add_action_or_reset(dev, xe_hwmon_mutex_destroy, hwmon)) + return; /* primary GT to access device level properties */ hwmon->gt = xe->tiles[0].primary_gt;