mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/uio
History
Guanghui Feng 35f1026070 uio: Fix use-after-free in uio_open 
commit 0c9ae0b860 upstream.

core-1				core-2
-------------------------------------------------------
uio_unregister_device		uio_open
				idev = idr_find()
device_unregister(&idev->dev)
put_device(&idev->dev)
uio_device_release
				get_device(&idev->dev)
kfree(idev)
uio_free_minor(minor)
				uio_release
				put_device(&idev->dev)
				kfree(idev)
-------------------------------------------------------

In the core-1 uio_unregister_device(), the device_unregister will kfree
idev when the idev->dev kobject ref is 1. But after core-1
device_unregister, put_device and before doing kfree, the core-2 may
get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double
   freed.

To address this issue, we can get idev atomic & inc idev reference with
minor_lock.

Fixes: 57c5f4df0a ("uio: fix crash after the device is unregistered")
Cc: stable <stable@kernel.org>
Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2024-01-20 11:51:48 +01:00
..
Kconfig uio: Remove leading spaces in Kconfig 2021-05-21 14:52:37 +02:00
Makefile uio: uio_dfl: add userspace i/o driver for DFL bus 2021-03-28 14:58:18 +02:00
uio.c uio: Fix use-after-free in uio_open 2024-01-20 11:51:48 +01:00
uio_aec.c uio: uio_aec: Use pci_iounmap instead of iounmap 2021-05-14 13:39:47 +02:00
uio_cif.c uio: uio_cif: use devm_kzalloc() for uio_info object 2020-12-09 19:59:00 +01:00
uio_dfl.c uio: dfl: add vendor-specific feature id 2023-05-31 19:00:37 +01:00
uio_dmem_genirq.c uio: uio_dmem_genirq: Use non-atomic bit operations in irq config and handling 2022-11-10 18:54:29 +01:00
uio_fsl_elbc_gpcm.c uio: uio_fsl_elbc_gpcm: Replace NO_IRQ by 0 2022-11-10 18:39:19 +01:00
uio_hv_generic.c Drivers: hv: Make remove callback of hyperv driver void returned 2023-01-17 13:41:27 +00:00
uio_mf624.c uio: uio_mf624: use devm_kzalloc() for uio_info object 2020-12-09 19:58:54 +01:00
uio_netx.c uio: uio_netx: use devm_kzalloc() for or uio_info object 2020-12-09 19:58:54 +01:00
uio_pci_generic.c Merge 50f09a3dd5 ("Merge tag 'char-misc-5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc") into char-misc-next 2021-05-21 09:48:31 +02:00
uio_pdrv_genirq.c
…
uio_pruss.c uio: pruss: fix missing iounmap() in pruss_probe() 2023-08-22 13:41:55 +02:00
uio_sercos3.c uio: uio_sercos3: use device-managed functions for simple allocs 2020-12-09 19:58:54 +01:00