linux-kernel - [PATCH 0/3] platform/chrome: Fix a possible UAF via ref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250814091020.1302888-1-tzungbi@kernel.org>
Date: Thu, 14 Aug 2025 09:10:17 +0000
From: Tzung-Bi Shih <tzungbi@...nel.org>
To: bleung@...omium.org
Cc: tzungbi@...nel.org,
	dawidn@...gle.com,
	chrome-platform@...ts.linux.dev,
	akpm@...ux-foundation.org,
	gregkh@...uxfoundation.org,
	linux-kernel@...r.kernel.org,
	Laurent Pinchart <laurent.pinchart@...asonboard.com>,
	Bartosz Golaszewski <bartosz.golaszewski@...aro.org>,
	Wolfram Sang <wsa+renesas@...g-engineering.com>
Subject: [PATCH 0/3] platform/chrome: Fix a possible UAF via ref_proxy

This is a follow-up series of [1].  It tries to fix a possible UAF in the
fops of cros_ec_chardev after the underlying protocol device has gone by
using a newly introduced ref_proxy library.

The 1st patch introduces the ref_proxy which is an implementation of ideas
from the talk [2].

The 2nd patch converts existing protocol devices to resource providers
of cros_ec_device.

The 3rd patch converts cros_ec_chardev to a resource consumer of
cros_ec_device to fix the UAF.

[1] https://lore.kernel.org/chrome-platform/20250721044456.2736300-6-tzungbi@kernel.org/
[2] https://lpc.events/event/17/contributions/1627/

Cc: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
Cc: Wolfram Sang <wsa+renesas@...g-engineering.com>

Tzung-Bi Shih (3):
  lib: Add ref_proxy module
  platform/chrome: Protect cros_ec_device lifecycle with ref_proxy
  platform/chrome: cros_ec_chardev: Consume cros_ec_device via ref_proxy

 drivers/platform/chrome/Kconfig             |   8 +-
 drivers/platform/chrome/cros_ec_chardev.c   | 125 ++++++++-----
 drivers/platform/chrome/cros_ec_i2c.c       |   5 +
 drivers/platform/chrome/cros_ec_ishtp.c     |   5 +
 drivers/platform/chrome/cros_ec_lpc.c       |   5 +
 drivers/platform/chrome/cros_ec_rpmsg.c     |   5 +
 drivers/platform/chrome/cros_ec_spi.c       |   4 +
 drivers/platform/chrome/cros_ec_uart.c      |   5 +
 include/linux/platform_data/cros_ec_proto.h |   3 +
 include/linux/ref_proxy.h                   |  37 ++++
 lib/Kconfig                                 |   3 +
 lib/Makefile                                |   1 +
 lib/ref_proxy.c                             | 184 ++++++++++++++++++++
 13 files changed, 348 insertions(+), 42 deletions(-)
 create mode 100644 include/linux/ref_proxy.h
 create mode 100644 lib/ref_proxy.c

-- 
2.51.0.rc1.163.g2494970778-goog