linux-kernel - Re: [PATCH] kernel/resource: Fix return code check in __request_free_mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7f86af3c-15ba-6ad4-8f6e-1e814a6eac1f@redhat.com>
Date:   Wed, 12 May 2021 14:16:41 +0200
From:   David Hildenbrand <david@...hat.com>
To:     Alistair Popple <apopple@...dia.com>, akpm@...ux-foundation.org
Cc:     bsingharora@...il.com, dan.j.williams@...el.com,
        daniel.vetter@...ll.ch, gregkh@...uxfoundation.org,
        jglisse@...hat.com, jhubbard@...dia.com, linux-mm@...ck.org,
        smuchun@...il.com, linux-kernel@...r.kernel.org,
        kernel test robot <oliver.sang@...el.com>
Subject: Re: [PATCH] kernel/resource: Fix return code check in
 __request_free_mem_region

On 12.05.21 09:35, Alistair Popple wrote:
> Splitting an earlier version of a patch that allowed calling
> __request_region() while holding the resource lock into a series of
> patches required changing the return code for the newly introduced
> __request_region_locked().
> 
> Unfortunately this change was not carried through to a subsequent
> commit 56fd94919b8b ("kernel/resource: fix locking in
> request_free_mem_region") in the series. This resulted in a
> use-after-free due to freeing the struct resource without properly
> releasing it. Fix this by correcting the return code check so that the
> struct is not freed if the request to add it was successful.
> 
> Reported-by: kernel test robot <oliver.sang@...el.com>
> Fixes: 56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region")
> Signed-off-by: Alistair Popple <apopple@...dia.com>
> ---
>   kernel/resource.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/resource.c b/kernel/resource.c
> index 028a5ab18818..ca9f5198a01f 100644
> --- a/kernel/resource.c
> +++ b/kernel/resource.c
> @@ -1805,7 +1805,7 @@ static struct resource *__request_free_mem_region(struct device *dev,
>   				REGION_DISJOINT)
>   			continue;
>   
> -		if (!__request_region_locked(res, &iomem_resource, addr, size,
> +		if (__request_region_locked(res, &iomem_resource, addr, size,
>   						name, 0))
>   			break;
>   
> 

Ouch, missed that, would have expected this pops up right away when testing.

Reviewed-by: David Hildenbrand <david@...hat.com>

-- 
Thanks,

David / dhildenb