* [PATCH v3] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()
@ 2022-09-25 13:32 Hyunwoo Kim
2022-09-25 15:47 ` Helge Deller
0 siblings, 1 reply; 3+ messages in thread
From: Hyunwoo Kim @ 2022-09-25 13:32 UTC (permalink / raw)
To: steve.glendinning, deller; +Cc: linux-fbdev, dri-devel, imv4bel
A race condition may occur if the user physically removes the
USB device while calling open() for this device node.
This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.
So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
drivers/video/fbdev/smscufx.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index d7aa5511c361..e65bdc499c23 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len);
static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);
static void ufx_free_urb_list(struct ufx_data *dev);
+static DEFINE_MUTEX(disconnect_mutex);
+
/* reads a control register */
static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)
{
@@ -1071,9 +1073,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
if (user == 0 && !console)
return -EBUSY;
+ mutex_lock(&disconnect_mutex);
+
/* If the USB device is gone, we don't accept new opens */
- if (dev->virtualized)
+ if (dev->virtualized) {
+ mutex_unlock(&disconnect_mutex);
return -ENODEV;
+ }
dev->fb_count++;
@@ -1097,6 +1103,8 @@ static int ufx_ops_open(struct fb_info *info, int user)
pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
info->node, user, info, dev->fb_count);
+ mutex_unlock(&disconnect_mutex);
+
return 0;
}
@@ -1741,6 +1749,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
{
struct ufx_data *dev;
+ mutex_lock(&disconnect_mutex);
+
dev = usb_get_intfdata(interface);
pr_debug("USB disconnect starting\n");
@@ -1761,6 +1771,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
kref_put(&dev->kref, ufx_free);
/* consider ufx_data freed */
+
+ mutex_unlock(&disconnect_mutex);
}
static struct usb_driver ufx_driver = {
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v3] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()
2022-09-25 13:32 [PATCH v3] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open() Hyunwoo Kim
@ 2022-09-25 15:47 ` Helge Deller
2022-09-26 4:50 ` Hyunwoo Kim
0 siblings, 1 reply; 3+ messages in thread
From: Helge Deller @ 2022-09-25 15:47 UTC (permalink / raw)
To: Hyunwoo Kim, steve.glendinning; +Cc: linux-fbdev, dri-devel
On 9/25/22 15:32, Hyunwoo Kim wrote:
> A race condition may occur if the user physically removes the
> USB device while calling open() for this device node.
>
> This is a race condition between the ufx_ops_open() function and
> the ufx_usb_disconnect() function, which may eventually result in UAF.
>
> So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
> to avoid race contidion of krefs.
>
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
applied.
Thanks!
Helge
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v3] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()
2022-09-25 15:47 ` Helge Deller
@ 2022-09-26 4:50 ` Hyunwoo Kim
0 siblings, 0 replies; 3+ messages in thread
From: Hyunwoo Kim @ 2022-09-26 4:50 UTC (permalink / raw)
To: Helge Deller; +Cc: steve.glendinning, linux-fbdev, dri-devel
Thank you for your review.
Best Regards,
Hyunwoo Kim.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-09-26 4:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-25 13:32 [PATCH v3] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open() Hyunwoo Kim
2022-09-25 15:47 ` Helge Deller
2022-09-26 4:50 ` Hyunwoo Kim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).