CVE-2024-53193

clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider

High · published December 27, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider

Some heap space is allocated for the flexible structure `struct

clk_hw_onecell_data` and its flexible-array member `hws` through

the composite structure `struct loongson2_clk_provider` in function

`loongson2_clk_probe()`, as shown below:

289 struct loongson2_clk_provider *clp;

...

296 for (p = data; p->name; p++)

297 clks_num++;

298

299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),

300 GFP_KERNEL);

Then some data is written into the flexible array:

350 clp->clk_data.hws[p->id] = hw;

This corrupts `clk_lock`, which is the spinlock variable immediately

following the `clk_data` member in `struct loongson2_clk_provider`:

struct loongson2_clk_provider {

void __iomem *base;

struct device *dev;

struct clk_hw_onecell_data clk_data;

spinlock_t clk_lock; /* protect access to DIV registers */

};

The problem is that the flexible structure is currently placed in the

middle of `struct loongson2_clk_provider` instead of at the end.

Fix this by moving `struct clk_hw_onecell_data clk_data;` to the end of

`struct loongson2_clk_provider`. Also, add a code comment to help

prevent this from happening again in case new members are added to the

structure in the future.

This change also fixes the following -Wflex-array-member-not-at-end

warning:

drivers/clk/clk-loongson2.c:32:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Published
2024-12-27T13:49Z
EPSS history
Timeline
  • 27 DEC 13:49Z
    clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider
    cvelistv5