iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fsi: occ: Prevent use after free

Browse Source 
Use get_device and put_device in the open and close functions to
make sure the device doesn't get freed while a file descriptor is
open.
Also, lock around the freeing of the device buffer and check the
buffer before using it in the submit function.

Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20220513194424.53468-1-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
This commit is contained in:
Eddie James 2022-05-13 14:44:24 -05:00 committed by Joel Stanley
parent dbed963ed6
commit d3e1e24604
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/fsi/fsi-occ.c
View File

@ -94,6 +94,7 @@ static int occ_open(struct inode *inode, struct file *file)
client->occ = occ; client->occ = occ;
mutex_init(&client->lock); mutex_init(&client->lock);
file->private_data = client; file->private_data = client;
get_device(occ->dev);
/* We allocate a 1-page buffer, make sure it all fits */ /* We allocate a 1-page buffer, make sure it all fits */
BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE); BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE);
@ -197,6 +198,7 @@ static int occ_release(struct inode *inode, struct file *file)
{ {
struct occ_client *client = file->private_data; struct occ_client *client = file->private_data;
put_device(client->occ->dev);
free_page((unsigned long)client->buffer); free_page((unsigned long)client->buffer);
kfree(client); kfree(client);
@ -493,12 +495,19 @@ int fsi_occ_submit(struct device *dev, const void *request, size_t req_len,
for (i = 1; i < req_len - 2; ++i) for (i = 1; i < req_len - 2; ++i)
checksum += byte_request[i]; checksum += byte_request[i];
mutex_lock(&occ->occ_lock); rc = mutex_lock_interruptible(&occ->occ_lock);
if (rc)
return rc;
occ->client_buffer = response; occ->client_buffer = response;
occ->client_buffer_size = user_resp_len; occ->client_buffer_size = user_resp_len;
occ->client_response_size = 0; occ->client_response_size = 0;
if (!occ->buffer) {
rc = -ENOENT;
goto done;
}
/* /*
* Get a sequence number and update the counter. Avoid a sequence * Get a sequence number and update the counter. Avoid a sequence
* number of 0 which would pass the response check below even if the * number of 0 which would pass the response check below even if the
@ -674,10 +683,13 @@ static int occ_remove(struct platform_device *pdev)
{ {
struct occ *occ = platform_get_drvdata(pdev); struct occ *occ = platform_get_drvdata(pdev);
kvfree(occ->buffer);
misc_deregister(&occ->mdev); misc_deregister(&occ->mdev);
mutex_lock(&occ->occ_lock);
kvfree(occ->buffer);
occ->buffer = NULL;
mutex_unlock(&occ->occ_lock);
device_for_each_child(&pdev->dev, NULL, occ_unregister_child); device_for_each_child(&pdev->dev, NULL, occ_unregister_child);
ida_simple_remove(&occ_ida, occ->idx); ida_simple_remove(&occ_ida, occ->idx);