netdev - [PATCH] mISDN: hfcpci: Fix use-after-free bug in hfcpci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2022 20:57:29 +0800
From:   Duoming Zhou <duoming@....edu.cn>
To:     linux-kernel@...r.kernel.org
Cc:     netdev@...r.kernel.org, isdn@...ux-pingi.de, kuba@...nel.org,
        gregkh@...uxfoundation.org, andrii@...nel.org, davem@...emloft.net,
        axboe@...nel.dk, Duoming Zhou <duoming@....edu.cn>
Subject: [PATCH] mISDN: hfcpci: Fix use-after-free bug in hfcpci_Timer

If the timer handler hfcpci_Timer() is running, the
del_timer(&hc->hw.timer) in release_io_hfcpci() could
not stop it. As a result, the use-after-free bug will
happen. The process is shown below:

    (cleanup routine)          |        (timer handler)
release_card()                 | hfcpci_Timer()
  release_io_hfcpci            |
    del_timer(&hc->hw.timer)   |
  ...                          |  ...
  kfree(hc) //[1]FREE          |
                               |   hc->hw.timer.expires //[2]USE

The hfc_pci is deallocated in position [1] and used in
position [2].

Fix by changing del_timer() in release_io_hfcpci() to
del_timer_sync(), which makes sure the hfcpci_Timer()
have finished before the hfc_pci is deallocated.

Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver")
Signed-off-by: Duoming Zhou <duoming@....edu.cn>
---
 drivers/isdn/hardware/mISDN/hfcpci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index af17459c1a5..5cf37fe7de2 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -157,7 +157,7 @@ release_io_hfcpci(struct hfc_pci *hc)
 {
 	/* disable memory mapped ports + busmaster */
 	pci_write_config_word(hc->pdev, PCI_COMMAND, 0);
-	del_timer(&hc->hw.timer);
+	del_timer_sync(&hc->hw.timer);
 	dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos,
 			  hc->hw.dmahandle);
 	iounmap(hc->hw.pci_io);
-- 
2.17.1