• Lukasz Bartosik's avatar
    clk: fix invalid usage of list cursor in unregister · 70454655
    Lukasz Bartosik authored
    Fix invalid usage of a list_for_each_entry cursor in
    clk_notifier_unregister(). When list is empty or if the list
    is completely traversed (without breaking from the loop on one
    of the entries) then the list cursor does not point to a valid
    entry and therefore should not be used. The patch fixes a logical
    bug that hasn't been seen in pratice however it is analogus
    to the bug fixed in clk_notifier_register().
    
    The issue was dicovered when running 5.12-rc1 kernel on x86_64
    with KASAN enabled:
    BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
    Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
    
    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
    Hardware name: Google Caroline/Caroline,
    BIOS Google_Caroline.7820.430.0 07/20/2018
    Call Trace:
     dump_stack+0xee/0x15c
     print_address_description+0x1e/0x2dc
     kasan_report+0x188/0x1ce
     ? clk_notifier_register+0xab/0x230
     ? clk_prepare_lock+0x15/0x7b
     ? clk_notifier_register+0xab/0x230
     clk_notifier_register+0xab/0x230
     dw8250_probe+0xc01/0x10d4
     ...
     Memory state around the buggy address:
      ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
      ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
     >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
                              ^
      ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
      ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
      ==================================================================
    
    Fixes: b2476490 ("clk: introduce the common clock framework")
    Reported-by: default avatarLukasz Majczak <lma@semihalf.com>
    Signed-off-by: default avatarLukasz Bartosik <lb@semihalf.com>
    Link: https://lore.kernel.org/r/20210401225149.18826-2-lb@semihalf.comSigned-off-by: default avatarStephen Boyd <sboyd@kernel.org>
    70454655
clk.c 128 KB