lkml.org 
[lkml]   [2021]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 237/315] misc/libmasm/module: Fix two use after free in ibmasm_init_one
    Date
    From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

    [ Upstream commit 7272b591c4cb9327c43443f67b8fbae7657dd9ae ]

    In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
    Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
    allocated by input_allocate_device(), and assigned to
    sp->remote.mouse_dev and sp->remote.keybd_dev respectively.

    In the err_free_devices error branch of ibmasm_init_one,
    mouse_dev and keybd_dev are freed by input_free_device(), and return
    error. Then the execution runs into error_send_message error branch
    of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
    to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.

    My patch add a "error_init_remote" label to handle the error of
    ibmasm_init_remote_input_dev(), to avoid the uaf bugs.

    Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/misc/ibmasm/module.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
    index c5a456b0a564..5bd62eebbb8a 100644
    --- a/drivers/misc/ibmasm/module.c
    +++ b/drivers/misc/ibmasm/module.c
    @@ -123,7 +123,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
    result = ibmasm_init_remote_input_dev(sp);
    if (result) {
    dev_err(sp->dev, "Failed to initialize remote queue\n");
    - goto error_send_message;
    + goto error_init_remote;
    }

    result = ibmasm_send_driver_vpd(sp);
    @@ -143,8 +143,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
    return 0;

    error_send_message:
    - disable_sp_interrupts(sp->base_address);
    ibmasm_free_remote_input_dev(sp);
    +error_init_remote:
    + disable_sp_interrupts(sp->base_address);
    free_irq(sp->irq, (void *)sp);
    error_request_irq:
    iounmap(sp->base_address);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-19 18:10    [W:4.058 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site