linux-kernel - [PATCH] kernel/resource: Fix return code check in __request_free_mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210512073528.22334-1-apopple@nvidia.com>
Date:   Wed, 12 May 2021 17:35:28 +1000
From:   Alistair Popple <apopple@...dia.com>
To:     <akpm@...ux-foundation.org>
CC:     <bsingharora@...il.com>, <dan.j.williams@...el.com>,
        <daniel.vetter@...ll.ch>, <david@...hat.com>,
        <gregkh@...uxfoundation.org>, <jglisse@...hat.com>,
        <jhubbard@...dia.com>, <linux-mm@...ck.org>, <smuchun@...il.com>,
        <linux-kernel@...r.kernel.org>,
        Alistair Popple <apopple@...dia.com>,
        kernel test robot <oliver.sang@...el.com>
Subject: [PATCH] kernel/resource: Fix return code check in __request_free_mem_region

Splitting an earlier version of a patch that allowed calling
__request_region() while holding the resource lock into a series of
patches required changing the return code for the newly introduced
__request_region_locked().

Unfortunately this change was not carried through to a subsequent
commit 56fd94919b8b ("kernel/resource: fix locking in
request_free_mem_region") in the series. This resulted in a
use-after-free due to freeing the struct resource without properly
releasing it. Fix this by correcting the return code check so that the
struct is not freed if the request to add it was successful.

Reported-by: kernel test robot <oliver.sang@...el.com>
Fixes: 56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region")
Signed-off-by: Alistair Popple <apopple@...dia.com>
---
 kernel/resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index 028a5ab18818..ca9f5198a01f 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1805,7 +1805,7 @@ static struct resource *__request_free_mem_region(struct device *dev,
 				REGION_DISJOINT)
 			continue;

-		if (!__request_region_locked(res, &iomem_resource, addr, size,
+		if (__request_region_locked(res, &iomem_resource, addr, size,
 						name, 0))
 			break;

-- 
2.20.1