lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 27 Nov 2015 05:44:52 +0000 (GMT)
From:	±θΑ€Ήθ <jb09.kim@...sung.com>
To:	sumit.semwal@...aro.org, gregkh@...uxfoundation.org,
	linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org,
	linaro-mm-sig@...ts.linaro.org, linux-kernel@...r.kernel.org,
	devel@...verdev.osuosl.org
Subject: [PATCH] driver:dma bug_fix : access freed memory

From 8f6aeb362d9e44f29d46ae7694cdfee4408406ce Mon Sep 17 00:00:00 2001
From: "KIM JUGNBAE" <jb09.kim@...sung.com>
Date: Thu, 26 Nov 2015 16:28:47 +0900
Subject: [PATCH] bug_fix : access freed memory

sync_fenc_free & fence_check_cb_func would be executed at
other cpu. fence_check_cb_func access freed fence memory after
kfree(fence) at sync_fence_free.
To escaped this issue, atomic_read(&fence->status) need to be
protected by child_list_lock.

Signed-off-by: "kimjungbae\" " <jb09.kim@...sung.com>"
---
 drivers/dma-buf/fence.c              |   13 +++++++++++++
 drivers/staging/android/sync.c       |   10 +++++++---
 drivers/staging/android/sync_debug.c |    2 ++
 include/linux/fence.h                |    1 +
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/dma-buf/fence.c b/drivers/dma-buf/fence.c
index 7bb9d65..d40211e 100644
--- a/drivers/dma-buf/fence.c
+++ b/drivers/dma-buf/fence.c
@@ -310,6 +310,19 @@ fence_remove_callback(struct fence *fence, struct fence_cb *cb)
 }
 EXPORT_SYMBOL(fence_remove_callback);
 
+bool
+fence_remove_callback_locked(struct fence *fence, struct fence_cb *cb)
+{
+	bool ret;
+
+	ret = !list_empty(&cb->node);
+	if (ret)
+		list_del_init(&cb->node);
+
+	return ret;
+}
+EXPORT_SYMBOL(fence_remove_callback_locked);
+
 struct default_wait_cb {
 	struct fence_cb base;
 	struct task_struct *task;
diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c
index 83f640f..9b60542 100644
--- a/drivers/staging/android/sync.c
+++ b/drivers/staging/android/sync.c
@@ -518,12 +518,16 @@ static const struct fence_ops android_fence_ops = {
 static void sync_fence_free(struct kref *kref)
 {
 	struct sync_fence *fence = container_of(kref, struct sync_fence, kref);
-	int i, status = atomic_read(&fence->status);
+	int i;
+	unsigned long flags;
 
 	for (i = 0; i < fence->num_fences; ++i) {
-		if (status)
-			fence_remove_callback(fence->cbs[i].sync_pt,
+		spin_lock_irqsave(fence->cbs[i].sync_pt->lock, flags);
+		if (atomic_read(&fence->status))
+			fence_remove_callback_locked(fence->cbs[i].sync_pt,
 					      &fence->cbs[i].cb);
+		spin_unlock_irqrestore(fence->cbs[i].sync_pt->lock, flags);
+
 		fence_put(fence->cbs[i].sync_pt);
 	}
 
diff --git a/drivers/staging/android/sync_debug.c b/drivers/staging/android/sync_debug.c
index 0153cd2..e854f35 100644
--- a/drivers/staging/android/sync_debug.c
+++ b/drivers/staging/android/sync_debug.c
@@ -155,7 +155,9 @@ static void sync_print_fence(struct seq_file *s, struct sync_fence *fence)
 			container_of(fence->cbs[i].sync_pt,
 				     struct sync_pt, base);
 
+		spin_lock_irqsave(pt->base.lock, flags);
 		sync_print_pt(s, pt, true);
+		spin_unlock_irqrestore(pt->base.lock, flags);
 	}
 
 	spin_lock_irqsave(&fence->wq.lock, flags);
diff --git a/include/linux/fence.h b/include/linux/fence.h
index d174585..a5a3fd1 100644
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -224,6 +224,7 @@ signed long fence_default_wait(struct fence *fence, bool intr, signed long timeo
 int fence_add_callback(struct fence *fence, struct fence_cb *cb,
 		       fence_func_t func);
 bool fence_remove_callback(struct fence *fence, struct fence_cb *cb);
+bool fence_remove_callback_locked(struct fence *fence, struct fence_cb *cb);
 void fence_enable_sw_signaling(struct fence *fence);
 
 /**
-- 
1.7.9.5

Powered by blists - more mailing lists