Skip to content
Snippets Groups Projects
Commit 4b472e21 authored by Hyunwoo Kim's avatar Hyunwoo Kim Committed by Yongqiang Liu
Browse files

fbdev: smscufx: Fix use-after-free in ufx_ops_open()

mainline inclusion
from mainline-v6.0-rc1
commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c
category: bugfix
bugzilla: 187798, https://gitee.com/src-openeuler/kernel/issues/I5U1NZ


CVE: CVE-2022-41849

--------------------------------

A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: default avatarHyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarChenXiaoSong <chenxiaosong2@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent edb25e44
No related branches found
No related tags found
No related merge requests found
...@@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len); ...@@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len);
static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size); static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);
static void ufx_free_urb_list(struct ufx_data *dev); static void ufx_free_urb_list(struct ufx_data *dev);
static DEFINE_MUTEX(disconnect_mutex);
/* reads a control register */ /* reads a control register */
static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data) static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)
{ {
...@@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *info, int user) ...@@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
if (user == 0 && !console) if (user == 0 && !console)
return -EBUSY; return -EBUSY;
mutex_lock(&disconnect_mutex);
/* If the USB device is gone, we don't accept new opens */ /* If the USB device is gone, we don't accept new opens */
if (dev->virtualized) if (dev->virtualized) {
mutex_unlock(&disconnect_mutex);
return -ENODEV; return -ENODEV;
}
dev->fb_count++; dev->fb_count++;
...@@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *info, int user) ...@@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *info, int user)
pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d", pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
info->node, user, info, dev->fb_count); info->node, user, info, dev->fb_count);
mutex_unlock(&disconnect_mutex);
return 0; return 0;
} }
...@@ -1747,6 +1755,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) ...@@ -1747,6 +1755,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
{ {
struct ufx_data *dev; struct ufx_data *dev;
mutex_lock(&disconnect_mutex);
dev = usb_get_intfdata(interface); dev = usb_get_intfdata(interface);
pr_debug("USB disconnect starting\n"); pr_debug("USB disconnect starting\n");
...@@ -1767,6 +1777,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) ...@@ -1767,6 +1777,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
kref_put(&dev->kref, ufx_free); kref_put(&dev->kref, ufx_free);
/* consider ufx_data freed */ /* consider ufx_data freed */
mutex_unlock(&disconnect_mutex);
} }
static struct usb_driver ufx_driver = { static struct usb_driver ufx_driver = {
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment