kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/clk
History
Stephen Boyd 2bf0e785c5 clk: Fix slab corruption in clk_unregister() 
commit 874f224cc5 upstream.

When a clock is unregsitered, we iterate over the list of
children and reparent them to NULL (i.e. orphan list). While
iterating the list, we should use the safe iterators because the
children list for this clock is changing when we reparent the
children to NULL. Failure to iterate safely can lead to slab
corruption like this:

=============================================================================
BUG kmalloc-128 (Not tainted): Poison overwritten
-----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: 0xed0c4900-0xed0c4903. First byte 0x0 instead of 0x6b
INFO: Allocated in clk_register+0x20/0x1bc age=297 cpu=2 pid=70
 __slab_alloc.isra.39.constprop.42+0x410/0x454
 kmem_cache_alloc_trace+0x200/0x24c
 clk_register+0x20/0x1bc
 devm_clk_register+0x34/0x68
 0xbf0000f0
 platform_drv_probe+0x18/0x48
 driver_probe_device+0x94/0x360
 __driver_attach+0x94/0x98
 bus_for_each_dev+0x54/0x88
 bus_add_driver+0xe8/0x204
 driver_register+0x78/0xf4
 do_one_initcall+0xc4/0x17c
 load_module+0x19ac/0x2294
 SyS_init_module+0xa4/0x110
 ret_fast_syscall+0x0/0x48
INFO: Freed in clk_unregister+0xd4/0x140 age=23 cpu=2 pid=73
 __slab_free+0x38/0x41c
 clk_unregister+0xd4/0x140
 release_nodes+0x164/0x1d8
 __device_release_driver+0x60/0xb0
 driver_detach+0xb4/0xb8
 bus_remove_driver+0x5c/0xc4
 SyS_delete_module+0x148/0x1d8
 ret_fast_syscall+0x0/0x48
INFO: Slab 0xeec50b90 objects=25 used=0 fp=0xed0c5400 flags=0x4080
INFO: Object 0xed0c48c0 @offset=2240 fp=0xed0c4a00

Bytes b4 ed0c48b0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
Object ed0c48c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ed0c48d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ed0c48e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ed0c48f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ed0c4900: 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  ....kkkkkkkkkkkk
Object ed0c4910: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ed0c4920: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ed0c4930: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
Redzone ed0c4940: bb bb bb bb                                      ....
Padding ed0c49e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
Padding ed0c49f8: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
CPU: 3 PID: 75 Comm: mdev Tainted: G    B         3.14.0-11033-g2054ba5ca781 #35
[<c0014be0>] (unwind_backtrace) from [<c0012240>] (show_stack+0x10/0x14)
[<c0012240>] (show_stack) from [<c04b74a0>] (dump_stack+0x70/0xbc)
[<c04b74a0>] (dump_stack) from [<c00f7a78>] (check_bytes_and_report+0xbc/0x100)
[<c00f7a78>] (check_bytes_and_report) from [<c00f7c48>] (check_object+0x18c/0x218)
[<c00f7c48>] (check_object) from [<c00f7efc>] (__free_slab+0x104/0x144)
[<c00f7efc>] (__free_slab) from [<c04b6668>] (__slab_free+0x3dc/0x41c)
[<c04b6668>] (__slab_free) from [<c014c008>] (load_elf_binary+0x88/0x12b4)
[<c014c008>] (load_elf_binary) from [<c0105a44>] (search_binary_handler+0x78/0x18c)
[<c0105a44>] (search_binary_handler) from [<c0106fc0>] (do_execve+0x490/0x5dc)
[<c0106fc0>] (do_execve) from [<c0036b8c>] (____call_usermodehelper+0x134/0x168)
[<c0036b8c>] (____call_usermodehelper) from [<c000f048>] (ret_from_fork+0x14/0x2c)
FIX kmalloc-128: Restoring 0xed0c4900-0xed0c4903=0x6b

Fixes: fcb0ee6a3d (clk: Implement clk_unregister)
Cc: Jiada Wang <jiada_wang@mentor.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2014-06-07 10:28:27 -07:00
..
at91 clk:at91: Fix memory leak in of_at91_clk_master_setup() 2014-02-26 18:00:56 -08:00
hisilicon clk: hi3620: add gate clock flag 2013-12-11 16:42:23 +08:00
keystone clk: keystone: gate: fix clk_init_data initialization 2014-02-10 15:17:43 -05:00
mmp clk: add CLK_SET_RATE_NO_REPARENT flag 2013-08-19 12:27:17 -07:00
mvebu clk: mvebu: kirkwood: maintain clock init order 2014-02-06 18:07:01 +00:00
mxs ARM: mxs: remove custom .init_time hook 2013-09-29 21:09:34 +02:00
qcom clk: qcom: Fix modular build 2014-01-17 13:39:42 -08:00
rockchip clk: add support for Rockchip gate clocks 2013-06-20 15:58:27 -07:00
samsung The second half of the clock framework pull requeust for 3.14 is 2014-01-28 18:44:53 -08:00
shmobile Single fix for a clock driver merged in 3.14-rc1. Without this fix the 2014-03-08 10:51:30 -08:00
sirf clk: sirf: re-arch to make the codes support both prima2 and atlas6 2014-01-16 12:00:53 -08:00
socfpga clk: socfpga: Use NULL instead of 0 2013-12-19 17:47:32 -08:00
spear clk: SPEAr: Staticize clk_frac_ops 2013-12-19 11:45:17 -08:00
sunxi clk: sunxi: fix overflow when setting up divided factors 2014-01-27 12:28:23 -08:00
tegra clk: tegra: Fix wrong value written to PLLE_AUX 2014-06-07 10:28:15 -07:00
ti CLK: TI: OMAP4/5/DRA7: Remove gpmc_fck from dummy clocks 2014-05-06 07:59:21 -07:00
ux500 clk: ux500: Remove extra semicolon 2013-12-19 17:47:33 -08:00
versatile clk: vexpress: NULL dereference on error path 2014-06-07 10:28:19 -07:00
x86 ACPI / LPSS: add support for Intel BayTrail 2013-06-19 01:08:47 +02:00
zynq clk/zynq/clkc: Add 'fclk-enable' feature 2013-12-20 13:23:55 +01:00
clk-axi-clkgen.c clk: Add axi-clkgen driver 2013-03-19 17:20:30 -07:00
clk-bcm2835.c ARM: bcm2835: remove custom .init_time hook 2013-09-29 21:09:24 +02:00
clk-composite.c clk: composite: pass mux_hw into determine_rate 2014-01-15 07:48:03 -08:00
clk-devres.c ARM: 7537/1: clk: Fix release in devm_clk_put() 2012-09-19 21:51:27 +01:00
clk-divider.c clk: clk-divider: fix divisor > 255 bug 2014-01-08 08:33:12 -08:00
clk-efm32gg.c clk: new driver for efm32 SoC 2013-11-04 12:23:18 -08:00
clk-fixed-factor.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-11-15 16:47:22 -08:00
clk-fixed-rate.c clk: add accuracy support for fixed clock 2013-12-22 23:14:28 -08:00
clk-gate.c clk: wrap I/O access for improved portability 2013-08-27 17:50:38 -07:00
clk-highbank.c ARM: highbank: remove custom .init_time hook 2013-09-29 21:09:29 +02:00
clk-ls1x.c clk: add Loongson1B clock support 2012-08-31 11:05:18 -07:00
clk-max77686.c clk: max77686: Register OF clock provider 2014-01-08 09:57:07 -08:00
clk-mux.c clk: wrap I/O access for improved portability 2013-08-27 17:50:38 -07:00
clk-nomadik.c clk: nomadik: fix multiplatform problem 2014-02-26 11:14:44 -08:00
clk-nspire.c clk: Add TI-Nspire clock drivers 2013-05-31 12:07:45 -07:00
clk-ppc-corenet.c powerpc: add missing explicit OF includes for ppc 2013-11-11 09:10:50 -06:00
clk-s2mps11.c clk: s2mps11: Fix possible NULL pointer dereference 2014-05-06 07:59:36 -07:00
clk-si570.c clk: si570: Remove redundant of_match_ptr helper 2013-12-22 22:46:52 -08:00
clk-si5351.c The second half of the clock framework pull requeust for 3.14 is 2014-01-28 18:44:53 -08:00
clk-si5351.h clk: si5351: remove variant from platform_data 2014-01-27 11:20:22 -08:00
clk-twl6040.c clk: use platform_{get,set}_drvdata() 2013-05-30 18:19:34 -07:00
clk-u300.c clk: u300: Fix incorrect placement of __initconst 2013-08-27 18:34:09 -07:00
clk-vt8500.c clk: vt8500: Staticize vtwm_pll_ops 2013-12-19 17:47:32 -08:00
clk-wm831x.c clk: wm831x: get rid of the implementation of remove function 2013-10-02 01:23:34 -07:00
clk-xgene.c clk: Add APM X-Gene SoC clock driver 2013-10-07 11:22:15 -07:00
clk.c clk: Fix slab corruption in clk_unregister() 2014-06-07 10:28:27 -07:00
clk.h clk: Provide not locked variant of of_clk_get_from_provider() 2013-12-04 17:19:30 +01:00
clkdev.c clkdev: Fix race condition in clock lookup from device tree 2013-12-04 17:19:36 +01:00
Kconfig clk: qcom: Add a regmap type clock struct 2014-01-16 12:00:58 -08:00
Makefile The second half of the clock framework pull requeust for 3.14 is 2014-01-28 18:44:53 -08:00