Skip to content

[Bug] GICv3 ITS cleanup path removes list node after freeing it #11604

Closed
Closed
[Bug] GICv3 ITS cleanup path removes list node after freeing it#11604

Description

@K-ANOY
K-ANOY
opened on Jul 9, 2026

RT-Thread Version

v5.0.2-2673-gac6dc197a0

Hardware Type/Architectures

Likely affects ARM platforms using the GICv3 ITS driver. The issue is in: components/drivers/pic/pic-gicv3-its.c

Develop Toolchain

Other

Describe the bug

In components/drivers/pic/pic-gicv3-its.c, the _free_all cleanup path in gicv3_its_ofw_probe() frees each struct gicv3_its object before removing its embedded list node:

_free_all:
    rt_list_for_each_entry_safe(its, its_next, &its_nodes, list)
    {
        rt_free(its);
        rt_list_remove(&its->list);
    }

    return err;

After rt_free(its), accessing its->list in rt_list_remove(&its->list) is a use-after-free.

The same file already has a helper that uses the safe order and also releases associated resources:

static void its_init_fail(struct gicv3_its *its)
{
    if (its->base)
    {
        rt_iounmap(its->base);
    }

    if (its->cmd_base)
    {
        rt_free_align(its->cmd_base);
    }

    for (int i = 0; i < RT_ARRAY_SIZE(its->tbls); ++i)
    {
        struct its_table *tbl = &its->tbls[i];

        if (tbl->base)
        {
            rt_free_align(tbl->base);
        }
    }

    rt_list_remove(&its->list);
    rt_free(its);
}

The _free_all branch should not free its before using its->list.

Other additional context

No response

Activity

  1. GuEe-GUI commented on Jul 12, 2026

    @GuEe-GUI
    GuEe-GUI
    on Jul 12, 2026
    Contributor

    Like this?

    diff --git a/components/drivers/pic/pic-gicv3-its.c b/components/drivers/pic/pic-gicv3-its.c
index 33f033fefd..7fdbb82773 100755
--- a/components/drivers/pic/pic-gicv3-its.c
+++ b/components/drivers/pic/pic-gicv3-its.c
@@ -1482,6 +1482,7 @@ rt_err_t gicv3_its_ofw_probe(struct rt_ofw_node *np, const struct rt_ofw_node_id
             goto _free_all;
         }
 
+        rt_list_init(&its->list);
         its->base = rt_ofw_iomap(its_np, 0);
 
         if (!its->base)
@@ -1501,7 +1502,6 @@ rt_err_t gicv3_its_ofw_probe(struct rt_ofw_node *np, const struct rt_ofw_node_id
         }
 
         its->np = its_np;
-        rt_list_init(&its->list);
         rt_list_insert_before(&its_nodes, &its->list);
     }
 
@@ -1577,8 +1577,7 @@ rt_err_t gicv3_its_ofw_probe(struct rt_ofw_node *np, const struct rt_ofw_node_id
 _free_all:
     rt_list_for_each_entry_safe(its, its_next, &its_nodes, list)
     {
-        rt_free(its);
-        rt_list_remove(&its->list);
+        its_init_fail(its);
     }
 
     return err;

  2. K-ANOY commented on Jul 12, 2026

    @K-ANOY
    K-ANOY
    on Jul 12, 2026
    Author

    Thanks! The patch looks good and fixes the use-after-free issue.

  3. GuEe-GUI
    added a commit that references this issue on Jul 20, 2026

    [pic][gicv3-its] fixup cleanup path removes list node after freeing it

    c3b60a0

  4. GuEe-GUI commented on Jul 20, 2026

    @GuEe-GUI
    GuEe-GUI
    on Jul 20, 2026
    Contributor

    #11637

  5. Rbb666
    added a commit that references this issue on Jul 20, 2026

    [pic][gicv3-its] fixup cleanup path removes list node after freeing it

    c22b393
  6. Rbb666
    closed this as completedon Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions