* [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
@ 2023-04-21 8:29 Duoming Zhou
2023-05-02 0:38 ` Dmitry Torokhov
0 siblings, 1 reply; 5+ messages in thread
From: Duoming Zhou @ 2023-04-21 8:29 UTC (permalink / raw)
To: linux-input; +Cc: linux-kernel, linus.walleij, dmitry.torokhov, Duoming Zhou
The watchdog_timer can schedule tx_timeout_task and watchdog_work
can also arm watchdog_timer. The process is shown below:
----------- timer schedules work ------------
cyttsp4_watchdog_timer() //timer handler
schedule_work(&cd->watchdog_work)
----------- work arms timer ------------
cyttsp4_watchdog_work() //workqueue callback function
cyttsp4_start_wd_timer()
mod_timer(&cd->watchdog_timer, ...)
Although del_timer_sync() and cancel_work_sync() are called in
cyttsp4_remove(), the timer and workqueue could still be rearmed.
As a result, the possible use after free bugs could happen. The
process is shown below:
(cleanup routine) | (timer and workqueue routine)
cyttsp4_remove() | cyttsp4_watchdog_timer() //timer
cyttsp4_stop_wd_timer() | schedule_work()
del_timer_sync() |
| cyttsp4_watchdog_work() //worker
| cyttsp4_start_wd_timer()
| mod_timer()
cancel_work_sync() |
| cyttsp4_watchdog_timer() //timer
| schedule_work()
del_timer_sync() |
kfree(cd) //FREE |
| cyttsp4_watchdog_work() // reschedule!
| cd-> //USE
This patch changes del_timer_sync() to timer_shutdown_sync(),
which could prevent rearming of the timer from the workqueue.
Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
drivers/input/touchscreen/cyttsp4_core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index 0cd6f626ade..7cb26929dc7 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -1263,9 +1263,8 @@ static void cyttsp4_stop_wd_timer(struct cyttsp4 *cd)
* Ensure we wait until the watchdog timer
* running on a different CPU finishes
*/
- del_timer_sync(&cd->watchdog_timer);
+ timer_shutdown_sync(&cd->watchdog_timer);
cancel_work_sync(&cd->watchdog_work);
- del_timer_sync(&cd->watchdog_timer);
}
static void cyttsp4_watchdog_timer(struct timer_list *t)
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
2023-04-21 8:29 [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync() Duoming Zhou
@ 2023-05-02 0:38 ` Dmitry Torokhov
0 siblings, 0 replies; 5+ messages in thread
From: Dmitry Torokhov @ 2023-05-02 0:38 UTC (permalink / raw)
To: Duoming Zhou; +Cc: linux-input, linux-kernel, linus.walleij
On Fri, Apr 21, 2023 at 04:29:19PM +0800, Duoming Zhou wrote:
> The watchdog_timer can schedule tx_timeout_task and watchdog_work
> can also arm watchdog_timer. The process is shown below:
>
> ----------- timer schedules work ------------
> cyttsp4_watchdog_timer() //timer handler
> schedule_work(&cd->watchdog_work)
>
> ----------- work arms timer ------------
> cyttsp4_watchdog_work() //workqueue callback function
> cyttsp4_start_wd_timer()
> mod_timer(&cd->watchdog_timer, ...)
>
> Although del_timer_sync() and cancel_work_sync() are called in
> cyttsp4_remove(), the timer and workqueue could still be rearmed.
> As a result, the possible use after free bugs could happen. The
> process is shown below:
>
> (cleanup routine) | (timer and workqueue routine)
> cyttsp4_remove() | cyttsp4_watchdog_timer() //timer
> cyttsp4_stop_wd_timer() | schedule_work()
> del_timer_sync() |
> | cyttsp4_watchdog_work() //worker
> | cyttsp4_start_wd_timer()
> | mod_timer()
> cancel_work_sync() |
> | cyttsp4_watchdog_timer() //timer
> | schedule_work()
> del_timer_sync() |
> kfree(cd) //FREE |
> | cyttsp4_watchdog_work() // reschedule!
> | cd-> //USE
>
> This patch changes del_timer_sync() to timer_shutdown_sync(),
> which could prevent rearming of the timer from the workqueue.
>
> Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Applied, thank you.
--
Dmitry
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
2023-09-08 6:15 ` Greg KH
@ 2023-09-08 6:34 ` Denis Efremov (Oracle)
0 siblings, 0 replies; 5+ messages in thread
From: Denis Efremov (Oracle) @ 2023-09-08 6:34 UTC (permalink / raw)
To: Greg KH; +Cc: stable, Duoming Zhou, Dmitry Torokhov
On 9/8/23 10:15, Greg KH wrote:
> On Fri, Sep 08, 2023 at 05:41:35AM +0400, Denis Efremov (Oracle) wrote:
>> From: Duoming Zhou <duoming@zju.edu.cn>
>>
>> The watchdog_timer can schedule tx_timeout_task and watchdog_work
>> can also arm watchdog_timer. The process is shown below:
>>
>> ----------- timer schedules work ------------
>> cyttsp4_watchdog_timer() //timer handler
>> schedule_work(&cd->watchdog_work)
>>
>> ----------- work arms timer ------------
>> cyttsp4_watchdog_work() //workqueue callback function
>> cyttsp4_start_wd_timer()
>> mod_timer(&cd->watchdog_timer, ...)
>>
>> Although del_timer_sync() and cancel_work_sync() are called in
>> cyttsp4_remove(), the timer and workqueue could still be rearmed.
>> As a result, the possible use after free bugs could happen. The
>> process is shown below:
>>
>> (cleanup routine) | (timer and workqueue routine)
>> cyttsp4_remove() | cyttsp4_watchdog_timer() //timer
>> cyttsp4_stop_wd_timer() | schedule_work()
>> del_timer_sync() |
>> | cyttsp4_watchdog_work() //worker
>> | cyttsp4_start_wd_timer()
>> | mod_timer()
>> cancel_work_sync() |
>> | cyttsp4_watchdog_timer() //timer
>> | schedule_work()
>> del_timer_sync() |
>> kfree(cd) //FREE |
>> | cyttsp4_watchdog_work() // reschedule!
>> | cd-> //USE
>>
>> This patch changes del_timer_sync() to timer_shutdown_sync(),
>> which could prevent rearming of the timer from the workqueue.
>>
>> Cc: stable@vger.kernel.org
>> Fixes: CVE-2023-4134
>
> "CVE" is not a valid Fixes tag :(
>
>> Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
>> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
>> Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cn
>> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
>> Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
>> ---
>>
>> I've only added Cc: stable and Fixes tag.
>
Please, don't take this patch. It breaks the build. Sorry, I forgot to check it this time.
I'll resend a correct backport with the upstream commit info.
Best Regards,
Denis
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
2023-09-08 1:41 Denis Efremov (Oracle)
@ 2023-09-08 6:15 ` Greg KH
2023-09-08 6:34 ` Denis Efremov (Oracle)
0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2023-09-08 6:15 UTC (permalink / raw)
To: Denis Efremov (Oracle); +Cc: stable, Duoming Zhou, Dmitry Torokhov
On Fri, Sep 08, 2023 at 05:41:35AM +0400, Denis Efremov (Oracle) wrote:
> From: Duoming Zhou <duoming@zju.edu.cn>
>
> The watchdog_timer can schedule tx_timeout_task and watchdog_work
> can also arm watchdog_timer. The process is shown below:
>
> ----------- timer schedules work ------------
> cyttsp4_watchdog_timer() //timer handler
> schedule_work(&cd->watchdog_work)
>
> ----------- work arms timer ------------
> cyttsp4_watchdog_work() //workqueue callback function
> cyttsp4_start_wd_timer()
> mod_timer(&cd->watchdog_timer, ...)
>
> Although del_timer_sync() and cancel_work_sync() are called in
> cyttsp4_remove(), the timer and workqueue could still be rearmed.
> As a result, the possible use after free bugs could happen. The
> process is shown below:
>
> (cleanup routine) | (timer and workqueue routine)
> cyttsp4_remove() | cyttsp4_watchdog_timer() //timer
> cyttsp4_stop_wd_timer() | schedule_work()
> del_timer_sync() |
> | cyttsp4_watchdog_work() //worker
> | cyttsp4_start_wd_timer()
> | mod_timer()
> cancel_work_sync() |
> | cyttsp4_watchdog_timer() //timer
> | schedule_work()
> del_timer_sync() |
> kfree(cd) //FREE |
> | cyttsp4_watchdog_work() // reschedule!
> | cd-> //USE
>
> This patch changes del_timer_sync() to timer_shutdown_sync(),
> which could prevent rearming of the timer from the workqueue.
>
> Cc: stable@vger.kernel.org
> Fixes: CVE-2023-4134
"CVE" is not a valid Fixes tag :(
> Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cn
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
> ---
>
> I've only added Cc: stable and Fixes tag.
What is the commit id in Linus's tree for this?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
@ 2023-09-08 1:41 Denis Efremov (Oracle)
2023-09-08 6:15 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: Denis Efremov (Oracle) @ 2023-09-08 1:41 UTC (permalink / raw)
To: stable; +Cc: Duoming Zhou, Dmitry Torokhov, Denis Efremov
From: Duoming Zhou <duoming@zju.edu.cn>
The watchdog_timer can schedule tx_timeout_task and watchdog_work
can also arm watchdog_timer. The process is shown below:
----------- timer schedules work ------------
cyttsp4_watchdog_timer() //timer handler
schedule_work(&cd->watchdog_work)
----------- work arms timer ------------
cyttsp4_watchdog_work() //workqueue callback function
cyttsp4_start_wd_timer()
mod_timer(&cd->watchdog_timer, ...)
Although del_timer_sync() and cancel_work_sync() are called in
cyttsp4_remove(), the timer and workqueue could still be rearmed.
As a result, the possible use after free bugs could happen. The
process is shown below:
(cleanup routine) | (timer and workqueue routine)
cyttsp4_remove() | cyttsp4_watchdog_timer() //timer
cyttsp4_stop_wd_timer() | schedule_work()
del_timer_sync() |
| cyttsp4_watchdog_work() //worker
| cyttsp4_start_wd_timer()
| mod_timer()
cancel_work_sync() |
| cyttsp4_watchdog_timer() //timer
| schedule_work()
del_timer_sync() |
kfree(cd) //FREE |
| cyttsp4_watchdog_work() // reschedule!
| cd-> //USE
This patch changes del_timer_sync() to timer_shutdown_sync(),
which could prevent rearming of the timer from the workqueue.
Cc: stable@vger.kernel.org
Fixes: CVE-2023-4134
Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
---
I've only added Cc: stable and Fixes tag.
drivers/input/touchscreen/cyttsp4_core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index dccbcb942fe5..f999265896f4 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -1263,9 +1263,8 @@ static void cyttsp4_stop_wd_timer(struct cyttsp4 *cd)
* Ensure we wait until the watchdog timer
* running on a different CPU finishes
*/
- del_timer_sync(&cd->watchdog_timer);
+ timer_shutdown_sync(&cd->watchdog_timer);
cancel_work_sync(&cd->watchdog_work);
- del_timer_sync(&cd->watchdog_timer);
}
static void cyttsp4_watchdog_timer(struct timer_list *t)
--
2.42.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-09-08 6:34 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-04-21 8:29 [PATCH] Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync() Duoming Zhou
2023-05-02 0:38 ` Dmitry Torokhov
2023-09-08 1:41 Denis Efremov (Oracle)
2023-09-08 6:15 ` Greg KH
2023-09-08 6:34 ` Denis Efremov (Oracle)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.