[Bug] GICv3 ITS cleanup path removes list node after freeing it

[K-ANOY]

RT-Thread Version

v5.0.2-2673-gac6dc197a0

Hardware Type/Architectures

Likely affects ARM platforms using the GICv3 ITS driver. The issue is in: components/drivers/pic/pic-gicv3-its.c

Develop Toolchain

Other

Describe the bug

In components/drivers/pic/pic-gicv3-its.c, the _free_all cleanup path in gicv3_its_ofw_probe() frees each struct gicv3_its object before removing its embedded list node:

_free_all:
    rt_list_for_each_entry_safe(its, its_next, &its_nodes, list)
    {
        rt_free(its);
        rt_list_remove(&its->list);
    }

    return err;

After rt_free(its), accessing its->list in rt_list_remove(&its->list) is a use-after-free.

The same file already has a helper that uses the safe order and also releases associated resources:

static void its_init_fail(struct gicv3_its *its)
{
    if (its->base)
    {
        rt_iounmap(its->base);
    }

    if (its->cmd_base)
    {
        rt_free_align(its->cmd_base);
    }

    for (int i = 0; i < RT_ARRAY_SIZE(its->tbls); ++i)
    {
        struct its_table *tbl = &its->tbls[i];

        if (tbl->base)
        {
            rt_free_align(tbl->base);
        }
    }

    rt_list_remove(&its->list);
    rt_free(its);
}

The _free_all branch should not free its before using its->list.

Other additional context

No response

[GuEe-GUI]

Like this?

diff --git a/components/drivers/pic/pic-gicv3-its.c b/components/drivers/pic/pic-gicv3-its.c
index 33f033fefd..7fdbb82773 100755
--- a/components/drivers/pic/pic-gicv3-its.c
+++ b/components/drivers/pic/pic-gicv3-its.c
@@ -1482,6 +1482,7 @@ rt_err_t gicv3_its_ofw_probe(struct rt_ofw_node *np, const struct rt_ofw_node_id
             goto _free_all;
         }
 
+        rt_list_init(&its->list);
         its->base = rt_ofw_iomap(its_np, 0);
 
         if (!its->base)
@@ -1501,7 +1502,6 @@ rt_err_t gicv3_its_ofw_probe(struct rt_ofw_node *np, const struct rt_ofw_node_id
         }
 
         its->np = its_np;
-        rt_list_init(&its->list);
         rt_list_insert_before(&its_nodes, &its->list);
     }
 
@@ -1577,8 +1577,7 @@ rt_err_t gicv3_its_ofw_probe(struct rt_ofw_node *np, const struct rt_ofw_node_id
 _free_all:
     rt_list_for_each_entry_safe(its, its_next, &its_nodes, list)
     {
-        rt_free(its);
-        rt_list_remove(&its->list);
+        its_init_fail(its);
     }
 
     return err;

[K-ANOY]

Thanks! The patch looks good and fixes the use-after-free issue.

[GuEe-GUI]

#11637