Re: [PATCH] soc: qcom: cmd-db: Fix probe race with possible ERR_PTR dereference

[Abel Vesa]

On 26-11-04 16:15:51, Krzysztof Kozlowski wrote:
> cmd_db_dev_probe() stores the result of devm_memremap() directly in the
> global "cmd_db_header" variable and only afterwards validates it, which
> opens a very short window where a concurrent thread could access and
> dereference stored ERR_PTR.
> 
> Theoretical (not reproduced) race condition could look like:
> 
>   CPU 0                               CPU 1
>   -----                               -----
>   cmd_db_dev_probe()
>     cmd_db_header = devm_memremap();
>     // holds ERR_PTR
>                                       cmd_db_ready()
>                                         if (cmd_db_header == NULL)
>                                           // false, proceeds
>                                         cmd_db_magic_matches(cmd_db_header);
>                                           // oops on ERR_PTR
>     if (IS_ERR(cmd_db_header))
>       cmd_db_header = NULL;
> 
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/bug/linux-1e6d9e1c-b97d-447c-9cbc-d874a0609918
> Fixes: 0da7824734d8 ("soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxxxxxxxx>

Reviewed-by: Abel Vesa <abel.vesa@xxxxxxxxxxxxxxxx>