kernel_samsung_a53x/drivers
Michael Kelley b7e60da381 Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
commit 07a756a49f4b4290b49ea46e089cbe6f79ff8d26 upstream.

If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is
fully initialized, we can hit the panic below:

hv_utils: Registering HyperV Utility Driver
hv_vmbus: registering driver hv_utils
...
BUG: kernel NULL pointer dereference, address: 0000000000000000
CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1
RIP: 0010:hv_pkt_iter_first+0x12/0xd0
Call Trace:
...
 vmbus_recvpacket
 hv_kvp_onchannelcallback
 vmbus_on_event
 tasklet_action_common
 tasklet_action
 handle_softirqs
 irq_exit_rcu
 sysvec_hyperv_stimer0
 </IRQ>
 <TASK>
 asm_sysvec_hyperv_stimer0
...
 kvp_register_done
 hvt_op_read
 vfs_read
 ksys_read
 __x64_sys_read

This can happen because the KVP/VSS channel callback can be invoked
even before the channel is fully opened:
1) as soon as hv_kvp_init() -> hvutil_transport_init() creates
/dev/vmbus/hv_kvp, the kvp daemon can open the device file immediately and
register itself to the driver by writing a message KVP_OP_REGISTER1 to the
file (which is handled by kvp_on_msg() ->kvp_handle_handshake()) and
reading the file for the driver's response, which is handled by
hvt_op_read(), which calls hvt->on_read(), i.e. kvp_register_done().

2) the problem with kvp_register_done() is that it can cause the
channel callback to be called even before the channel is fully opened,
and when the channel callback is starting to run, util_probe()->
vmbus_open() may have not initialized the ringbuffer yet, so the
callback can hit the panic of NULL pointer dereference.

To reproduce the panic consistently, we can add a "ssleep(10)" for KVP in
__vmbus_open(), just before the first hv_ringbuffer_init(), and then we
unload and reload the driver hv_utils, and run the daemon manually within
the 10 seconds.

Fix the panic by reordering the steps in util_probe() so the char dev
entry used by the KVP or VSS daemon is not created until after
vmbus_open() has completed. This reordering prevents the race condition
from happening.

Reported-by: Dexuan Cui <decui@microsoft.com>
Fixes: e0fa3e5e7df6 ("Drivers: hv: utils: fix a race on userspace daemons registration")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Link: https://lore.kernel.org/r/20241106154247.2271-3-mhklinux@outlook.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20241106154247.2271-3-mhklinux@outlook.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-15 16:29:46 +01:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-11-19 12:26:51 +01:00
acpi ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired 2025-01-02 17:01:17 +01:00
amba
android Revert "BACKPORT: FROMLIST: binder: fix freeze UAF in binder_release_work()" 2024-12-18 15:46:58 +01:00
ata ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() 2025-01-02 17:00:49 +01:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-11-23 23:20:43 +01:00
auxdisplay
base regmap: detach regmap from dev on regmap_exit 2024-12-17 13:24:29 +01:00
battery Revert "battery: sec_battery: export {CURRENT/VOLTAGE}_MAX to sysfs" 2024-12-18 20:58:37 +01:00
bcma
block zram: refuse to use zero sized block device as backing device 2025-01-15 16:29:45 +01:00
bluetooth Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables 2024-12-17 13:24:31 +01:00
bts
bus Revert "bus: integrator-lm: fix OF node leak in probe()" 2024-11-24 00:23:16 +01:00
cdrom
char Revert "tpm: Clean up TPM space after command failure" 2024-11-24 00:23:24 +01:00
clk Revert "clkdev: remove CONFIG_CLKDEV_LOOKUP" 2025-01-02 17:01:18 +01:00
clocksource Revert "clkdev: remove CONFIG_CLKDEV_LOOKUP" 2025-01-02 17:01:18 +01:00
connector
counter counter: ti-eqep: enable clock at probe 2024-11-19 14:19:33 +01:00
cpufreq cpufreq: loongson2: Unregister platform_driver on failure 2024-12-17 13:24:08 +01:00
cpuidle cpuidle: menu: Take negative "sleep length" values into account 2024-11-19 18:01:28 +01:00
crypto crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() 2024-12-17 13:24:00 +01:00
dax
dca
devfreq PM / devfreq: Fix buffer overflow in trans_stat_show 2024-11-19 11:32:38 +01:00
dio
dma dmaengine: dw: Add memory bus width verification 2024-11-23 23:20:55 +01:00
dma-buf dma-buf: fix dma_fence_array_signaled v4 2024-12-17 13:24:29 +01:00
edac EDAC/fsl_ddr: Fix bad bit shift operations 2024-12-17 13:23:59 +01:00
eisa
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-11-19 12:27:04 +01:00
fingerprint
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-11-19 11:32:46 +01:00
firmware firmware: arm_scpi: Check the DVFS OPP count returned by the firmware 2024-12-17 13:24:03 +01:00
fpga fpga: region: add owner module and take its refcount 2024-11-19 12:27:04 +01:00
fsi
gnss
gpio gpio: grgpio: Add NULL check in grgpio_probe 2024-12-17 13:24:27 +01:00
gpu drm/i915: Fix memory leak by correcting cache object name in error handler 2025-01-02 17:01:18 +01:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-11-19 14:19:05 +01:00
gud
hid HID: wacom: fix when get product name maybe null pointer 2024-12-17 13:24:28 +01:00
hsi
hv Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet 2025-01-15 16:29:46 +01:00
hwmon hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers 2025-01-15 16:29:45 +01:00
hwspinlock Revert "hwspinlock: Introduce hwspin_lock_bust()" 2024-11-24 00:23:48 +01:00
hwtracing Revert "coresight: tmc: sg: Do not leak sg_table" 2024-11-24 00:23:19 +01:00
i2c i2c: riic: Always round-up when calculating bus period 2025-01-15 16:29:41 +01:00
i3c i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock 2024-12-17 13:24:32 +01:00
ide
idle
ifconn
iio ad7780: fix division by zero in ad7780_write_raw() 2024-12-17 13:24:23 +01:00
infiniband RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() 2024-12-17 13:24:09 +01:00
input drivers: sec_input: stm_cmd.c: Expand snprintf sizes 2024-12-17 21:43:20 +01:00
interconnect Revert "interconnect: qcom: sm8250: Enable sync_state" 2024-11-24 00:23:19 +01:00
iommu iommu/arm-smmu: Defer probe of clients after smmu device bound 2024-12-17 13:24:29 +01:00
ipack
irqchip irqchip/gic-v3: Force propagation of the active state with a read-back 2024-11-30 02:33:26 +01:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-11-23 23:20:17 +01:00
kperfmon
kq/mesh
leds leds: class: Protect brightness_show() with led_cdev->led_access mutex 2024-12-17 13:24:32 +01:00
lightnvm
macintosh macintosh/therm_windtunnel: fix module unload. 2024-11-23 23:20:11 +01:00
mailbox Revert "mailbox: rockchip: fix a typo in module autoloading" 2024-11-24 00:23:13 +01:00
mcb
md bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again 2024-12-17 13:24:28 +01:00
media Reapply "mfc: Import IS_UHD_RES definition" 2024-12-18 11:46:00 +01:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-11-23 23:20:46 +01:00
memstick
message scsi: fusion: Remove unused variable 'rc' 2024-12-17 13:24:09 +01:00
mfd mfd: rt5033: Fix missing regmap_del_irq_chip() 2024-12-17 13:24:08 +01:00
misc misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle 2024-12-17 13:24:32 +01:00
mmc mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk 2025-01-15 16:29:41 +01:00
most
mtd ubi: fastmap: Fix duplicate slab cache names while attaching 2024-12-17 13:24:21 +01:00
muic
mux
net chelsio/chtls: prevent potential integer overflow on 32bit 2025-01-15 16:29:41 +01:00
nfc nfc: pn533: Add poll mod list filling check 2024-11-23 23:20:55 +01:00
ntb Revert "ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()" 2024-11-24 00:23:20 +01:00
nubus
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-17 13:24:32 +01:00
nvme nvme-pci: fix freeing of the HMB descriptor table 2024-12-17 13:23:59 +01:00
nvmem Revert "nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc" 2024-11-24 00:23:38 +01:00
of Revert "of/irq: Prevent device address out-of-bounds read in interrupt map walk" 2024-11-24 00:23:38 +01:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-11-19 08:44:49 +01:00
oprofile
parisc
parport Revert "parport: Proper fix for array out-of-bounds access" 2024-11-24 00:22:51 +01:00
pci PCI: Add ACS quirk for Broadcom BCM5760X NIC 2025-01-15 16:29:40 +01:00
pcmcia Revert "pcmcia: Use resource_size function on resource object" 2024-11-24 00:23:42 +01:00
perf
phy phy: tegra: xusb: Add API to retrieve the port number of phy 2024-11-19 09:22:34 +01:00
pinctrl pinctrl: qcom-pmic-gpio: add support for PM8937 2024-12-17 13:24:32 +01:00
platform platform/chrome: cros_ec_typec: fix missing fwnode reference decrement 2024-12-17 13:24:19 +01:00
pnp PNP: ACPI: fix fortify warning 2024-11-18 12:13:09 +01:00
power power: supply: bq27xxx: Fix registers of bq27426 2024-12-17 13:24:13 +01:00
powercap Revert "powercap: RAPL: fix invalid initialization for pl4_supported field" 2024-11-24 00:23:18 +01:00
pps Revert "pps: remove usage of the deprecated ida_simple_xx() API" 2024-11-24 00:23:14 +01:00
ps3
ptp ptp: Add error handling for adjfine callback in ptp_clock_adjtime 2024-12-17 13:24:25 +01:00
pwm pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle 2024-12-17 13:24:02 +01:00
rapidio
ras
regulator regulator: rk808: Add apply_bit for BUCK3 on RK809 2024-12-17 13:23:58 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region 2024-12-17 13:24:13 +01:00
reset Revert "reset: berlin: fix OF node leak in probe() error path" 2024-11-24 00:23:27 +01:00
rpmsg rpmsg: glink: Propagate TX failures in intentless mode as well 2024-12-17 13:24:21 +01:00
rtc rtc: ab-eoz9: don't fail temperature reads on undervoltage notification 2024-12-17 13:24:22 +01:00
s390 Revert "s390/zcore: no need to check return value of debugfs_create functions" 2024-11-24 00:22:59 +01:00
samsung
sbus
scsi scsi: core: Fix scsi_mode_select() buffer length handling 2024-12-17 13:24:35 +01:00
sensorhub
sensors
sfi
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-15 16:29:45 +01:00
siox
slimbus slimbus: core: Remove usage of the deprecated ida_simple_xx() API 2024-11-19 09:22:34 +01:00
soc drivers: samsung: exynos-cpupm.c: Fully nuke cpupm_debug 2024-12-18 18:43:43 +01:00
soundwire Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-11-24 00:23:49 +01:00
spi spi: mpc52xx: Add cancel_work_sync before module remove 2024-12-17 13:24:27 +01:00
spmi
spu_verify
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-11-23 23:20:44 +01:00
staging Revert "clkdev: remove CONFIG_CLKDEV_LOOKUP" 2025-01-02 17:01:18 +01:00
sti
target scsi: target: core: Fix null-ptr-deref in target_alloc_device() 2024-11-23 23:21:59 +01:00
tc
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-11-19 09:22:39 +01:00
thermal
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-11-23 23:20:42 +01:00
tty serial: 8250: omap: Move pm_runtime_get_sync 2024-12-17 13:24:19 +01:00
uh
uio Revert "uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind" 2024-11-24 00:23:37 +01:00
usb USB: serial: option: add MediaTek T7XX compositions 2025-01-15 16:29:41 +01:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-17 13:24:13 +01:00
vfio vfio/pci: Properly hide first-in-list PCIe extended capability 2024-12-17 13:24:13 +01:00
vhost Revert "vdpa: Add eventfd for the vdpa callback" 2024-11-24 00:23:19 +01:00
vibrator
video fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-12-17 13:24:09 +01:00
virt
virtio Revert "vdpa: Add eventfd for the vdpa callback" 2024-11-24 00:23:19 +01:00
vision
vision3
visorbus
vlynq
vme
w1
watchdog watchdog: rti: of: honor timeout-sec property 2024-12-17 13:24:28 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-17 13:24:17 +01:00
zorro
Kconfig Added KernelSU 2024-11-19 22:44:48 +01:00
Kconfig.variant1
kernelsu Revert "Welcome KernelSU-Next with SusFs" 2025-01-06 22:38:10 +01:00
Makefile Added KernelSU 2024-11-19 22:44:48 +01:00
Makefile.variant1