Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66e10d5f authored by Manivannan Sadhasivam's avatar Manivannan Sadhasivam Committed by Greg Kroah-Hartman
Browse files

EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info 



commit 977c6ba624f24ae20cf0faee871257a39348d4a9 upstream.

The memory for llcc_driv_data is allocated by the LLCC driver. But when
it is passed as the private driver info to the EDAC core, it will get freed
during the qcom_edac driver release. So when the qcom_edac driver gets probed
again, it will try to use the freed data leading to the use-after-free bug.

Hence, do not pass llcc_driv_data as pvt_info but rather reference it
using the platform_data pointer in the qcom_edac driver.

Fixes: 27450653 ("drivers: edac: Add EDAC driver support for QCOM SoCs")
Reported-by: default avatarSteev Klimaszewski <steev@kali.org>
Signed-off-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Tested-by: Steev Klimaszewski <steev@kali.org> # Thinkpad X13s
Tested-by: Andrew Halaney <ahalaney@redhat.com> # sa8540p-ride
Cc: <stable@vger.kernel.org> # 4.20
Link: https://lore.kernel.org/r/20230118150904.26913-4-manivannan.sadhasivam@linaro.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 594618c7

drivers/edac/qcom_edac.c

+2 −3
Original line number Diff line number Diff line
@@ -252,7 +252,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) 
static int

dump_syn_reg(struct edac_device_ctl_info *edev_ctl, int err_type, u32 bank)

{

	struct llcc_drv_data *drv = edev_ctl->pvt_info;

	struct llcc_drv_data *drv = edev_ctl->dev->platform_data;

	int ret;



	ret = dump_syn_reg_values(drv, bank, err_type);
@@ -289,7 +289,7 @@ static irqreturn_t 
llcc_ecc_irq_handler(int irq, void *edev_ctl)

{

	struct edac_device_ctl_info *edac_dev_ctl = edev_ctl;

	struct llcc_drv_data *drv = edac_dev_ctl->pvt_info;

	struct llcc_drv_data *drv = edac_dev_ctl->dev->platform_data;

	irqreturn_t irq_rc = IRQ_NONE;

	u32 drp_error, trp_error, i;

	int ret;
@@ -358,7 +358,6 @@ static int qcom_llcc_edac_probe(struct platform_device *pdev) 
	edev_ctl->dev_name = dev_name(dev);

	edev_ctl->ctl_name = "llcc";

	edev_ctl->panic_on_ue = LLCC_ERP_PANIC_ON_UE;

	edev_ctl->pvt_info = llcc_driv_data;



	rc = edac_device_add_device(edev_ctl);

	if (rc)