lkml.org 
[lkml]   [2021]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 294/601] spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
    Date
    From: Quanyang Wang <quanyang.wang@windriver.com>

    [ Upstream commit a2c5bedb2d55dd27c642c7b9fb6886d7ad7bdb58 ]

    When handling op->addr, it is using the buffer "tmpbuf" which has been
    freed. This will trigger a use-after-free KASAN warning. Let's use
    temporary variables to store op->addr.val and op->cmd.opcode to fix
    this issue.

    Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
    Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
    Link: https://lore.kernel.org/r/20210416004652.2975446-5-quanyang.wang@windriver.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/spi/spi-zynqmp-gqspi.c | 14 ++++----------
    1 file changed, 4 insertions(+), 10 deletions(-)

    diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
    index d6ac8fe145a1..2a0be16b2eb0 100644
    --- a/drivers/spi/spi-zynqmp-gqspi.c
    +++ b/drivers/spi/spi-zynqmp-gqspi.c
    @@ -926,8 +926,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
    struct zynqmp_qspi *xqspi = spi_controller_get_devdata
    (mem->spi->master);
    int err = 0, i;
    - u8 *tmpbuf;
    u32 genfifoentry = 0;
    + u16 opcode = op->cmd.opcode;
    + u64 opaddr;

    dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n",
    op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth,
    @@ -940,14 +941,8 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
    genfifoentry |= xqspi->genfifobus;

    if (op->cmd.opcode) {
    - tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA);
    - if (!tmpbuf) {
    - mutex_unlock(&xqspi->op_lock);
    - return -ENOMEM;
    - }
    - tmpbuf[0] = op->cmd.opcode;
    reinit_completion(&xqspi->data_completion);
    - xqspi->txbuf = tmpbuf;
    + xqspi->txbuf = &opcode;
    xqspi->rxbuf = NULL;
    xqspi->bytes_to_transfer = op->cmd.nbytes;
    xqspi->bytes_to_receive = 0;
    @@ -961,13 +956,12 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
    if (!wait_for_completion_timeout
    (&xqspi->data_completion, msecs_to_jiffies(1000))) {
    err = -ETIMEDOUT;
    - kfree(tmpbuf);
    goto return_err;
    }
    - kfree(tmpbuf);
    }

    if (op->addr.nbytes) {
    + xqspi->txbuf = &opaddr;
    for (i = 0; i < op->addr.nbytes; i++) {
    *(((u8 *)xqspi->txbuf) + i) = op->addr.val >>
    (8 * (op->addr.nbytes - i - 1));
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-05-12 19:32    [W:4.083 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site