kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers/hwtracing
History
Yeoreum Yun 3102881272 coresight: prevent deactivate active config while enabling the config 
[ Upstream commit 408c97c4a5 ]

While enable active config via cscfg_csdev_enable_active_config(),
active config could be deactivated via configfs' sysfs interface.
This could make UAF issue in below scenario:

CPU0                                          CPU1
(sysfs enable)                                load module
                                              cscfg_load_config_sets()
                                              activate config. // sysfs
                                              (sys_active_cnt == 1)
...
cscfg_csdev_enable_active_config()
lock(csdev->cscfg_csdev_lock)
// here load config activate by CPU1
unlock(csdev->cscfg_csdev_lock)

                                              deactivate config // sysfs
                                              (sys_activec_cnt == 0)
                                              cscfg_unload_config_sets()
                                              unload module

// access to config_desc which freed
// while unloading module.
cscfg_csdev_enable_config

To address this, use cscfg_config_desc's active_cnt as a reference count
 which will be holded when
    - activate the config.
    - enable the activated config.
and put the module reference when config_active_cnt == 0.

Fixes: f8cce2ff3c ("coresight: syscfg: Add API to activate and enable configurations")
Suggested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250514161951.3427590-4-yeoreum.yun@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-19 15:32:13 +02:00
..
coresight coresight: prevent deactivate active config while enabling the config 2025-06-19 15:32:13 +02:00
intel_th intel_th: avoid using deprecated page->mapping, index fields 2025-05-29 11:01:58 +02:00
ptt hwtracing: hisi_ptt: Assign parent for event_source device 2024-05-02 11:36:11 +01:00
stm [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
Kconfig hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00