git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 531390a243ef47448f8bad01c186c2787666bf4d Mon Sep 17 00:00:00 2001
   2 From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
   3 Date: Tue, 17 Jan 2023 18:06:10 +0900
   4 Subject: firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
   5
   6 From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
   7
   8 commit 531390a243ef47448f8bad01c186c2787666bf4d upstream.
   9
  10 This patch is fix for Linux kernel v2.6.33 or later.
  11
  12 For request subaction to IEC 61883-1 FCP region, Linux FireWire subsystem
  13 have had an issue of use-after-free. The subsystem allows multiple
  14 user space listeners to the region, while data of the payload was likely
  15 released before the listeners execute read(2) to access to it for copying
  16 to user space.
  17
  18 The issue was fixed by a commit 281e20323ab7 ("firewire: core: fix
  19 use-after-free regression in FCP handler"). The object of payload is
  20 duplicated in kernel space for each listener. When the listener executes
  21 ioctl(2) with FW_CDEV_IOC_SEND_RESPONSE request, the object is going to
  22 be released.
  23
  24 However, it causes memory leak since the commit relies on call of
  25 release_request() in drivers/firewire/core-cdev.c. Against the
  26 expectation, the function is never called due to the design of
  27 release_client_resource(). The function delegates release task
  28 to caller when called with non-NULL fourth argument. The implementation
  29 of ioctl_send_response() is the case. It should release the object
  30 explicitly.
  31
  32 This commit fixes the bug.
  33
  34 Cc: <stable@vger.kernel.org>
  35 Fixes: 281e20323ab7 ("firewire: core: fix use-after-free regression in FCP handler")
  36 Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
  37 Link: https://lore.kernel.org/r/20230117090610.93792-2-o-takashi@sakamocchi.jp
  38 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  39 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  40 ---
  41  drivers/firewire/core-cdev.c |    4 +++-
  42  1 file changed, 3 insertions(+), 1 deletion(-)
  43
  44 --- a/drivers/firewire/core-cdev.c
  45 +++ b/drivers/firewire/core-cdev.c
  46 @@ -818,8 +818,10 @@ static int ioctl_send_response(struct cl
  47
  48         r = container_of(resource, struct inbound_transaction_resource,
  49                          resource);
  50 -       if (is_fcp_request(r->request))
  51 +       if (is_fcp_request(r->request)) {
  52 +               kfree(r->data);
  53                 goto out;
  54 +       }
  55
  56         if (a->length != fw_get_response_length(r->request)) {
  57                 ret = -EINVAL;