lkml.org 
[lkml]   [2022]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 22/86] nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
    Date
    From: Duoming Zhou <duoming@zju.edu.cn>

    [ Upstream commit f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6 ]

    When the pn532 uart device is detaching, the pn532_uart_remove()
    is called. But there are no functions in pn532_uart_remove() that
    could delete the cmd_timeout timer, which will cause use-after-free
    bugs. The process is shown below:

    (thread 1) | (thread 2)
    | pn532_uart_send_frame
    pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...)
    ... | (wait a time)
    kfree(pn532) //FREE | pn532_cmd_timeout
    | pn532_uart_send_frame
    | pn532->... //USE

    This patch adds del_timer_sync() in pn532_uart_remove() in order to
    prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc()
    is well synchronized, it sets nfc_dev->shutting_down to true and there
    are no syscalls could restart the cmd_timeout timer.

    Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
    Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/nfc/pn533/uart.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/nfc/pn533/uart.c b/drivers/nfc/pn533/uart.c
    index a0665d8ea85bc..e92535ebb5287 100644
    --- a/drivers/nfc/pn533/uart.c
    +++ b/drivers/nfc/pn533/uart.c
    @@ -310,6 +310,7 @@ static void pn532_uart_remove(struct serdev_device *serdev)
    pn53x_unregister_nfc(pn532->priv);
    serdev_device_close(serdev);
    pn53x_common_clean(pn532->priv);
    + del_timer_sync(&pn532->cmd_timeout);
    kfree_skb(pn532->recv_skb);
    kfree(pn532);
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-29 13:37    [W:4.123 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site