[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <61786e1d-35dc-4cf1-a152-fba363c94520@grsecurity.net>
Date: Thu, 22 Feb 2024 15:19:49 +0100
From: Mathias Krause <minipli@...ecurity.net>
To: Dan Carpenter <dan.carpenter@...aro.org>,
Dmitry Torokhov <dmitry.torokhov@...il.com>,
Torsten Hilbrich <torsten.hilbrich@...unet.com>,
Nick Dyer <nick@...anahar.org>
Cc: Jiapeng Chong <jiapeng.chong@...ux.alibaba.com>,
linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
Brad Spengler <spender@...ecurity.net>, Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH] Input: synaptics-rmi4 - fix use after free (more
completely) -- but not fully ;)
On 22.02.24 15:08, Mathias Krause wrote:
>>
>> The bug is that we must not call device_del() until after calling
>> irq_dispose_mapping().
>
> Unfortunately, this is only half the truth. We investigated this further
> and there's another bug that got introduced in commit 24d28e4f1271
> ("Input: synaptics-rmi4 - convert irq distribution to irq_domain"). The
> IRQ domain has a UAF issue as well. I'll send the patch soon -- wanted
> to do so this week, but, again, more urgent matters interrupted this.
Unfortunately, I send that Email too fast. Looking at the backtrace
again, it's just the other bug that needs fixing (a UAF in
rmi_driver_remove()). Will sent a patch really soon now!
>
>>
>> Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
>> Reported-by: Torsten Hilbrich <torsten.hilbrich@...unet.com>
>> Closes: https://lore.kernel.org/all/1932038e-2776-04ac-5fcd-b15bb3cd088d@secunet.com/
>> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215604
>> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
>> ---
>> drivers/input/rmi4/rmi_bus.c | 5 ++---
>> 1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c
>> index 1b45b1d3077d..02acc81b9d3e 100644
>> --- a/drivers/input/rmi4/rmi_bus.c
>> +++ b/drivers/input/rmi4/rmi_bus.c
>> @@ -275,12 +275,11 @@ void rmi_unregister_function(struct rmi_function *fn)
>> rmi_dbg(RMI_DEBUG_CORE, &fn->dev, "Unregistering F%02X.\n",
>> fn->fd.function_number);
>>
>> - device_del(&fn->dev);
>> - of_node_put(fn->dev.of_node);
>> -
>> for (i = 0; i < fn->num_of_irqs; i++)
>> irq_dispose_mapping(fn->irq[i]);
>>
>> + device_del(&fn->dev);
>> + of_node_put(fn->dev.of_node);
>> put_device(&fn->dev);
>> }
>>
>
> Acked-by: Mathias Krause <minipli@...ecurity.net>
So, forget about that one, sorry.
Powered by blists - more mailing lists