linux-kernel - [PATCH] Input: synaptics-rmi4 - fix use after free (more completely)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e77756aa-c0f1-44a8-bcd6-a46fe954b195@moroto.mountain>
Date: Thu, 22 Feb 2024 11:53:24 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>,
	Torsten Hilbrich <torsten.hilbrich@...unet.com>,
	Nick Dyer <nick@...anahar.org>
Cc: Jiapeng Chong <jiapeng.chong@...ux.alibaba.com>,
	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
	Brad Spengler <spender@...ecurity.net>,
	Sasha Levin <sashal@...nel.org>
Subject: [PATCH] Input: synaptics-rmi4 - fix use after free (more completely)

From: Brad Spengler <spender@...ecurity.net>

Grsecurity uses memory poisoning and detected a use after free in
rmi_unregister_function().   A fix for this was merged into the
grsecurity patchset.  I detected the user after free later using static
analysis and sent a partial fix as commit eb988e46da2e ("Input:
synaptics-rmi4 - fix use after free in rmi_unregister_function()").
However, my patch meant that the grsecurity patchset didn't apply cleanly
and forced everyone to re-visit this issue.

The bug is that we must not call device_del() until after calling
irq_dispose_mapping().

Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
Reported-by: Torsten Hilbrich <torsten.hilbrich@...unet.com>
Closes: https://lore.kernel.org/all/1932038e-2776-04ac-5fcd-b15bb3cd088d@secunet.com/
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215604
Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
---
 drivers/input/rmi4/rmi_bus.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c
index 1b45b1d3077d..02acc81b9d3e 100644
--- a/drivers/input/rmi4/rmi_bus.c
+++ b/drivers/input/rmi4/rmi_bus.c
@@ -275,12 +275,11 @@ void rmi_unregister_function(struct rmi_function *fn)
 	rmi_dbg(RMI_DEBUG_CORE, &fn->dev, "Unregistering F%02X.\n",
 			fn->fd.function_number);
 
-	device_del(&fn->dev);
-	of_node_put(fn->dev.of_node);
-
 	for (i = 0; i < fn->num_of_irqs; i++)
 		irq_dispose_mapping(fn->irq[i]);
 
+	device_del(&fn->dev);
+	of_node_put(fn->dev.of_node);
 	put_device(&fn->dev);
 }
 
-- 
2.43.0