lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 110/862] fbdev: smscufx: Fix use-after-free in ufx_ops_open()
    Date
    From: Hyunwoo Kim <imv4bel@gmail.com>

    commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c upstream.

    A race condition may occur if the user physically removes the
    USB device while calling open() for this device node.

    This is a race condition between the ufx_ops_open() function and
    the ufx_usb_disconnect() function, which may eventually result in UAF.

    So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
    to avoid race contidion of krefs.

    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/video/fbdev/smscufx.c | 14 +++++++++++++-
    1 file changed, 13 insertions(+), 1 deletion(-)

    --- a/drivers/video/fbdev/smscufx.c
    +++ b/drivers/video/fbdev/smscufx.c
    @@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_dat
    static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);
    static void ufx_free_urb_list(struct ufx_data *dev);

    +static DEFINE_MUTEX(disconnect_mutex);
    +
    /* reads a control register */
    static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)
    {
    @@ -1071,9 +1073,13 @@ static int ufx_ops_open(struct fb_info *
    if (user == 0 && !console)
    return -EBUSY;

    + mutex_lock(&disconnect_mutex);
    +
    /* If the USB device is gone, we don't accept new opens */
    - if (dev->virtualized)
    + if (dev->virtualized) {
    + mutex_unlock(&disconnect_mutex);
    return -ENODEV;
    + }

    dev->fb_count++;

    @@ -1097,6 +1103,8 @@ static int ufx_ops_open(struct fb_info *
    pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
    info->node, user, info, dev->fb_count);

    + mutex_unlock(&disconnect_mutex);
    +
    return 0;
    }

    @@ -1741,6 +1749,8 @@ static void ufx_usb_disconnect(struct us
    {
    struct ufx_data *dev;

    + mutex_lock(&disconnect_mutex);
    +
    dev = usb_get_intfdata(interface);

    pr_debug("USB disconnect starting\n");
    @@ -1761,6 +1771,8 @@ static void ufx_usb_disconnect(struct us
    kref_put(&dev->kref, ufx_free);

    /* consider ufx_data freed */
    +
    + mutex_unlock(&disconnect_mutex);
    }

    static struct usb_driver ufx_driver = {

    \
     
     \ /
      Last update: 2022-10-19 10:53    [W:2.042 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site