iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5cbba60596
linux/drivers/nfc
History
Krzysztof Kozlowski 5e7b30d24a nfc: nfcsim: fix use after free during module unload 
There is a use after free memory corruption during module exit:
 - nfcsim_exit()
  - nfcsim_device_free(dev0)
    - nfc_digital_unregister_device()
      This iterates over command queue and frees all commands,
    - dev->up = false
    - nfcsim_link_shutdown()
      - nfcsim_link_recv_wake()
        This wakes the sleeping thread nfcsim_link_recv_skb().

 - nfcsim_link_recv_skb()
   Wake from wait_event_interruptible_timeout(),
   call directly the deb->cb callback even though (dev->up == false),
   - digital_send_cmd_complete()
     Dereference of "struct digital_cmd" cmd which was freed earlier by
     nfc_digital_unregister_device().

This causes memory corruption shortly after (with unrelated stack
trace):

  nfc nfc0: NFC: nfcsim_recv_wq: Device is down
  llcp: nfc_llcp_recv: err -19
  nfc nfc1: NFC: nfcsim_recv_wq: Device is down
  BUG: unable to handle page fault for address: ffffffffffffffed
  Call Trace:
   fsnotify+0x54b/0x5c0
   __fsnotify_parent+0x1fe/0x300
   ? vfs_write+0x27c/0x390
   vfs_write+0x27c/0x390
   ksys_write+0x63/0xe0
   do_syscall_64+0x3b/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae

KASAN report:

  BUG: KASAN: use-after-free in digital_send_cmd_complete+0x16/0x50
  Write of size 8 at addr ffff88800a05f720 by task kworker/0:2/71
  Workqueue: events nfcsim_recv_wq [nfcsim]
  Call Trace:
   dump_stack_lvl+0x45/0x59
   print_address_description.constprop.0+0x21/0x140
   ? digital_send_cmd_complete+0x16/0x50
   ? digital_send_cmd_complete+0x16/0x50
   kasan_report.cold+0x7f/0x11b
   ? digital_send_cmd_complete+0x16/0x50
   ? digital_dep_link_down+0x60/0x60
   digital_send_cmd_complete+0x16/0x50
   nfcsim_recv_wq+0x38f/0x3d5 [nfcsim]
   ? nfcsim_in_send_cmd+0x4a/0x4a [nfcsim]
   ? lock_is_held_type+0x98/0x110
   ? finish_wait+0x110/0x110
   ? rcu_read_lock_sched_held+0x9c/0xd0
   ? rcu_read_lock_bh_held+0xb0/0xb0
   ? lockdep_hardirqs_on_prepare+0x12e/0x1f0

This flow of calling digital_send_cmd_complete() callback on driver exit
is specific to nfcsim which implements reading and sending work queues.
Since the NFC digital device was unregistered, the callback should not
be called.

Fixes: 204bddcb50 ("NFC: nfcsim: Make use of the Digital layer")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-28 10:20:16 +01:00
..
fdp nfc: fdp: remove unnecessary labels 2021-06-11 12:50:32 -07:00
microread NFC: microread: Remove redundant assignment to variable err 2021-06-01 16:58:38 -07:00
nfcmrvl nfc: mrvl: reduce the scope of local variables 2021-06-03 13:59:08 -07:00
nxp-nci NFC: nxp-nci: remove unnecessary label 2021-06-18 12:57:30 -07:00
pn533 nfc: pn533: drop unneeded braces {} in if 2021-05-31 21:32:37 -07:00
pn544 nfc: pn544: drop ftrace-like debugging messages 2021-05-31 21:32:37 -07:00
s3fwrn5 nfc: s3fwrn5: fix undefined parameter values in dev_err() 2021-07-28 09:23:59 +01:00
st21nfca nfc: st21nfca: drop ftrace-like debugging messages 2021-05-31 21:32:37 -07:00
st95hf nfc: st95hf: fix indentation to tabs 2021-05-31 21:32:37 -07:00
st-nci nfc: st-nci: drop ftrace-like debugging messages 2021-05-31 21:32:37 -07:00
Kconfig nfc: Add a virtual nci device driver 2021-01-29 18:03:33 -08:00
Makefile nfc: Add a virtual nci device driver 2021-01-29 18:03:33 -08:00
mei_phy.c nfc: mei_phy: drop ftrace-like debugging messages 2021-05-31 21:31:08 -07:00
mei_phy.h
nfcsim.c nfc: nfcsim: fix use after free during module unload 2021-07-28 10:20:16 +01:00
port100.c nfc: port100: correct kerneldoc for structure 2021-05-28 15:05:55 -07:00
trf7970a.c nfc: fix typo 2021-01-25 19:35:26 -08:00
virtual_ncidev.c nfc: Add a virtual nci device driver 2021-01-29 18:03:33 -08:00