linux-kernel - [PATCH v2] misc: ti-st: st_kim: Fix use after free bug in kim

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 20 Mar 2023 14:24:35 +0800
From:   Zheng Wang <zyytlz.wz@....com>
To:     arnd@...db.de
Cc:     gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
        hackerzheng666@...il.com, 1395428693sheep@...il.com,
        alex000young@...il.com, Zheng Wang <zyytlz.wz@....com>
Subject: [PATCH v2] misc: ti-st: st_kim: Fix use after free bug in kim_remove due  to race condition

In kim_probe, it called st_core_init and bound &st_gdata->work_write_wakeup
with work_fn_write_wakeup.
When it calls st_tty_wakeup, it will finally call schedule_work to start
the work.

When we call kim_remove to remove the driver, there
may be a sequence as follows:

Fix it by finishing the work before cleanup in kim_remove

CPU0                  CPU1

                    |work_fn_write_wakeup
kim_remove          |
  st_core_exit      |
     kfree(st_gdata)|
                    |st_tx_wakeup
                    |//use st_gdata

Fixes: b05b7c7cc032 ("ti-st: use worker instead of calling st_int_write in wake up")
Signed-off-by: Zheng Wang <zyytlz.wz@....com>
---
v2:
- fix error from kernek_test-robot
---
 drivers/misc/ti-st/st_kim.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index f2f6cab97c08..497ba8d8df27 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -785,8 +785,12 @@ static int kim_remove(struct platform_device *pdev)
 	/* free the GPIOs requested */
 	struct ti_st_plat_data	*pdata = pdev->dev.platform_data;
 	struct kim_data_s	*kim_gdata;
+	struct st_data_s *st_gdata;
 
 	kim_gdata = platform_get_drvdata(pdev);
+	st_gdata = kim_gdata->core_data;
+
+	cancel_work_sync(&st_gdata->work_write_wakeup);
 
 	/*
 	 * Free the Bluetooth/FM/GPIO
@@ -800,7 +804,7 @@ static int kim_remove(struct platform_device *pdev)
 	pr_info("sysfs entries removed");
 
 	kim_gdata->kim_pdev = NULL;
-	st_core_exit(kim_gdata->core_data);
+	st_core_exit(st_gdata);
 
 	kfree(kim_gdata);
 	kim_gdata = NULL;
-- 
2.25.1