git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 61850725779709369c7e907ae8c7c75dc7cec4f3 Mon Sep 17 00:00:00 2001
   2 From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
   3 Date: Sun, 15 Sep 2024 00:39:33 +0800
   4 Subject: i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
   5
   6 From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
   7
   8 commit 61850725779709369c7e907ae8c7c75dc7cec4f3 upstream.
   9
  10 In the svc_i3c_master_probe function, &master->hj_work is bound with
  11 svc_i3c_master_hj_work, &master->ibi_work is bound with
  12 svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work  can start the
  13 hj_work, svc_i3c_master_irq_handler can start the ibi_work.
  14
  15 If we remove the module which will call svc_i3c_master_remove to
  16 make cleanup, it will free master->base through i3c_master_unregister
  17 while the work mentioned above will be used. The sequence of operations
  18 that may lead to a UAF bug is as follows:
  19
  20 CPU0                                         CPU1
  21
  22                                     | svc_i3c_master_hj_work
  23 svc_i3c_master_remove               |
  24 i3c_master_unregister(&master->base)|
  25 device_unregister(&master->dev)     |
  26 device_release                      |
  27 //free master->base                 |
  28                                     | i3c_master_do_daa(&master->base)
  29                                     | //use master->base
  30
  31 Fix it by ensuring that the work is canceled before proceeding with the
  32 cleanup in svc_i3c_master_remove.
  33
  34 Fixes: 0f74f8b6675c ("i3c: Make i3c_master_unregister() return void")
  35 Cc: stable@vger.kernel.org
  36 Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn>
  37 Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
  38 Reviewed-by: Frank Li <Frank.Li@nxp.com>
  39 Link: https://lore.kernel.org/stable/20240914154030.180-1-kxwang23%40m.fudan.edu.cn
  40 Link: https://lore.kernel.org/r/20240914163932.253-1-kxwang23@m.fudan.edu.cn
  41 Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
  42 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  43 ---
  44  drivers/i3c/master/svc-i3c-master.c |    1 +
  45  1 file changed, 1 insertion(+)
  46
  47 --- a/drivers/i3c/master/svc-i3c-master.c
  48 +++ b/drivers/i3c/master/svc-i3c-master.c
  49 @@ -1775,6 +1775,7 @@ static void svc_i3c_master_remove(struct
  50  {
  51         struct svc_i3c_master *master = platform_get_drvdata(pdev);
  52
  53 +       cancel_work_sync(&master->hj_work);
  54         i3c_master_unregister(&master->base);
  55
  56         pm_runtime_dont_use_autosuspend(&pdev->dev);