* [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()
@ 2021-11-04 15:32 Chengfeng Ye
2021-11-04 21:32 ` kernel test robot
0 siblings, 1 reply; 2+ messages in thread
From: Chengfeng Ye @ 2021-11-04 15:32 UTC (permalink / raw)
To: stefanr; +Cc: linux1394-devel, linux-kernel, Chengfeng Ye
&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
drivers/firewire/core-cdev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 9f89c17730b1..2f47e31918f0 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1516,9 +1516,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
}
e->phy_packet.data[0] = packet->timestamp;
+ struct client *e_client = e->client;
queue_event(e->client, &e->event, &e->phy_packet,
sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
- client_put(e->client);
+ client_put(e_client);
}
static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()
2021-11-04 15:32 [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback() Chengfeng Ye
@ 2021-11-04 21:32 ` kernel test robot
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2021-11-04 21:32 UTC (permalink / raw)
To: Chengfeng Ye, stefanr
Cc: llvm, kbuild-all, linux1394-devel, linux-kernel, Chengfeng Ye
[-- Attachment #1: Type: text/plain, Size: 3152 bytes --]
Hi Chengfeng,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on ieee1394-linux1394/for-next]
[also build test WARNING on v5.15 next-20211104]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Chengfeng-Ye/firewire-fix-potential-uaf-in-outbound_phy_packet_callback/20211104-233441
base: https://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394.git for-next
config: x86_64-randconfig-r034-20211105 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 847a6807332b13f43704327c2d30103ec0347c77)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/4374c2eea7055a681ca81f925ded194d11062af6
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Chengfeng-Ye/firewire-fix-potential-uaf-in-outbound_phy_packet_callback/20211104-233441
git checkout 4374c2eea7055a681ca81f925ded194d11062af6
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
>> drivers/firewire/core-cdev.c:1499:17: warning: ISO C90 forbids mixing declarations and code [-Wdeclaration-after-statement]
struct client *e_client = e->client;
^
1 warning generated.
vim +1499 drivers/firewire/core-cdev.c
1477
1478 static void outbound_phy_packet_callback(struct fw_packet *packet,
1479 struct fw_card *card, int status)
1480 {
1481 struct outbound_phy_packet_event *e =
1482 container_of(packet, struct outbound_phy_packet_event, p);
1483
1484 switch (status) {
1485 /* expected: */
1486 case ACK_COMPLETE: e->phy_packet.rcode = RCODE_COMPLETE; break;
1487 /* should never happen with PHY packets: */
1488 case ACK_PENDING: e->phy_packet.rcode = RCODE_COMPLETE; break;
1489 case ACK_BUSY_X:
1490 case ACK_BUSY_A:
1491 case ACK_BUSY_B: e->phy_packet.rcode = RCODE_BUSY; break;
1492 case ACK_DATA_ERROR: e->phy_packet.rcode = RCODE_DATA_ERROR; break;
1493 case ACK_TYPE_ERROR: e->phy_packet.rcode = RCODE_TYPE_ERROR; break;
1494 /* stale generation; cancelled; on certain controllers: no ack */
1495 default: e->phy_packet.rcode = status; break;
1496 }
1497 e->phy_packet.data[0] = packet->timestamp;
1498
> 1499 struct client *e_client = e->client;
1500 queue_event(e->client, &e->event, &e->phy_packet,
1501 sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
1502 client_put(e_client);
1503 }
1504
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 31912 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-04 21:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-04 15:32 [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback() Chengfeng Ye
2021-11-04 21:32 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).