linux-kernel - [PATCH] platform/x86: dell_rbu: fix lock imbalance in img_update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190211130940.28206-1-hch@lst.de>
Date:   Mon, 11 Feb 2019 14:09:40 +0100
From:   Christoph Hellwig <hch@....de>
To:     stuart.w.hayes@...il.com, dvhart@...radead.org, andy@...radead.org
Cc:     platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: [PATCH] platform/x86: dell_rbu: fix lock imbalance in img_update_realloc

We need to ensure rbu_data.lock is always held on return.

Fixes: 289790a3ea94 ("platform/x86: dell_rbu: stop abusing the DMA API")
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Christoph Hellwig <hch@....de>
---
 drivers/platform/x86/dell_rbu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/dell_rbu.c b/drivers/platform/x86/dell_rbu.c
index 8104ca0c44ca..031c68903583 100644
--- a/drivers/platform/x86/dell_rbu.c
+++ b/drivers/platform/x86/dell_rbu.c
@@ -436,6 +436,7 @@ static int img_update_realloc(unsigned long size)
 	ordernum = get_order(size);
 	image_update_buffer =
 		(unsigned char *)__get_free_pages(GFP_DMA32, ordernum);
+	spin_lock(&rbu_data.lock);
 	if (!image_update_buffer) {
 		pr_debug("Not enough memory for image update:"
 			"size = %ld\n", size);
@@ -446,7 +447,6 @@ static int img_update_realloc(unsigned long size)
 	if (WARN_ON_ONCE(img_buf_phys_addr > BIOS_SCAN_LIMIT))
 		return -EINVAL; /* can't happen per definition */
 
-	spin_lock(&rbu_data.lock);
 	rbu_data.image_update_buffer = image_update_buffer;
 	rbu_data.image_update_buffer_size = size;
 	rbu_data.bios_image_size = rbu_data.image_update_buffer_size;
-- 
2.20.1