lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 079/343] driver: uio: fix possible use-after-free in __uio_register_device
    Date
    From: Liu Jian <liujian56@huawei.com>

    [ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]

    In uio_dev_add_attributes() error handing case, idev is used after
    device_unregister(), in which 'idev' has been released, touch idev cause
    use-after-free.

    Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
    Signed-off-by: Liu Jian <liujian56@huawei.com>
    Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/uio/uio.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
    index 4e9b0ff79b131..7c18536a3742a 100644
    --- a/drivers/uio/uio.c
    +++ b/drivers/uio/uio.c
    @@ -944,6 +944,7 @@ int __uio_register_device(struct module *owner,
    return ret;
    }

    + device_initialize(&idev->dev);
    idev->dev.devt = MKDEV(uio_major, idev->minor);
    idev->dev.class = &uio_class;
    idev->dev.parent = parent;
    @@ -954,7 +955,7 @@ int __uio_register_device(struct module *owner,
    if (ret)
    goto err_device_create;

    - ret = device_register(&idev->dev);
    + ret = device_add(&idev->dev);
    if (ret)
    goto err_device_create;

    @@ -986,9 +987,10 @@ int __uio_register_device(struct module *owner,
    err_request_irq:
    uio_dev_del_attributes(idev);
    err_uio_dev_add_attributes:
    - device_unregister(&idev->dev);
    + device_del(&idev->dev);
    err_device_create:
    uio_free_minor(idev);
    + put_device(&idev->dev);
    return ret;
    }
    EXPORT_SYMBOL_GPL(__uio_register_device);
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 10:48    [W:4.973 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site