Root Cause Analysis

1. Functions, Structs, Fields, and Files Involved

• Source File: drivers/greybus/operation.c
• Functions: gb_operation_request_send(), gb_operation_work(), _gb_operation_destroy()
• Structs & Fields:
  • struct gb_operation:
    • operation->timer (struct timer_list)
    • operation->work (struct work_struct)
    • operation->kref (struct kref)
    • operation->errno

2. Mechanism & Invariant Violation

In gb_operation_request_send() (drivers/greybus/operation.c):

int gb_operation_request_send(struct gb_operation *operation,
			      gb_operation_callback callback,
			      unsigned int timeout,
			      gfp_t gfp)
{
	...
	gb_operation_result_set(operation, -EINPROGRESS);

	gb_operation_get(operation);
	ret = gb_operation_get_active(operation);
	if (ret)
		goto err_put;

	ret = gb_message_send(operation->request, gfp);
	if (ret)
		goto err_put_active;

	if (timeout) {
		operation->timer.expires = jiffies + msecs_to_jiffies(timeout);
		add_timer(&operation->timer);
	}

	return 0;
...

1. Premature Exposure: Once gb_operation_get_active() and gb_message_send() execute, the operation is made active on the connection and dispatched to the host device. However, operation->timer is only armed after message transmission via add_timer(&operation->timer).
2. Concurrent Completion/Cancellation: As soon as the operation is sent/active, it can complete or be cancelled asynchronously from another context (e.g., via gb_connection_recv_response(), greybus_message_sent(), or gb_operation_cancel()). This sets the final result and schedules operation->work (gb_operation_work) on gb_operation_completion_wq.
3. The Race Condition:
   • If gb_operation_work() executes on another CPU before the calling thread in gb_operation_request_send() executes add_timer(&operation->timer):

     static void gb_operation_work(struct work_struct *work)
     {
         ...
         ret = timer_delete_sync(&operation->timer);
         ...
         operation->callback(operation);
         ...
         gb_operation_put_active(operation);
         gb_operation_put(operation);
     }
     

   • timer_delete_sync(&operation->timer) runs while the timer is not yet armed; it returns 0 and does nothing.
   • The original thread then runs add_timer(&operation->timer), linking operation->timer into the kernel timer wheel after the cleanup check has already passed.
   • Meanwhile, operation->callback() completes the operation (waking synchronous waiters if any, which release their reference via gb_operation_put()), and gb_operation_work() drops the remaining references with gb_operation_put().
   • When the refcount drops to 0, _gb_operation_destroy() frees the struct gb_operation slab object via kmem_cache_free(gb_operation_cache, operation).
4. Invariant Violated: A struct timer_list embedded inside an allocated structure must be deactivated/deleted before the enclosing memory block is freed. In this race, operation->timer remains actively enrolled in the kernel's timer wheel when operation is returned to the slab allocator.

With CONFIG_DEBUG_OBJECTS=y, debug_check_no_obj_freed() intercepts the free in kmem_cache_free() and detects that the embedded timer_list at offset 0xd0 is still in the active state, emitting the ODEBUG: free active ... object type: timer_list hint: gb_operation_timeout warning.

3. Production Runtime Impact & Classification

• Memory Corruption (MemoryCorruption = true): In a production kernel without CONFIG_DEBUG_OBJECTS, struct gb_operation is freed while operation->timer remains linked into the per-CPU timer wheel list. When the timer expires, the kernel timer engine executes gb_operation_timeout(&operation->timer) on freed (or reallocated) memory, causing a use-after-free (UAF). Additionally, timer wheel list modifications on dangling node pointers cause heap memory corruption.
• Denial of Service (RawDenialOfService = true): The use-after-free or timer wheel list corruption will crash the kernel (kernel panic or general protection fault / oops) when the timer expires or when neighboring timers in the wheel list are processed.
• Information Leak (InfoLeak = "none"): No uninitialized kernel memory or kernel pointers are leaked or copied back to userspace or external entities.
• Virtualization / KVM (IsKVMCandidate = false): The bug is entirely within the Greybus subsystem and does not touch KVM, hypervisors, or virtualization devices.
• Networking (IsNetCandidate = false): Greybus is a hardware bus protocol/architecture (UniPro application layer) and does not involve network protocols, sockets, or network devices.