Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3742e9fd authored by Hyunwoo Kim's avatar Hyunwoo Kim Committed by Greg Kroah-Hartman
Browse files

fbdev: smscufx: Fix use-after-free in ufx_ops_open() 



commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c upstream.

A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: default avatarHyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 52895c49

drivers/video/fbdev/smscufx.c

+13 −1
Original line number Diff line number Diff line
@@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len); 
static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);

static void ufx_free_urb_list(struct ufx_data *dev);



static DEFINE_MUTEX(disconnect_mutex);



/* reads a control register */

static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)

{
@@ -1070,9 +1072,13 @@ static int ufx_ops_open(struct fb_info *info, int user) 
	if (user == 0 && !console)

		return -EBUSY;



	mutex_lock(&disconnect_mutex);



	/* If the USB device is gone, we don't accept new opens */

	if (dev->virtualized)

	if (dev->virtualized) {

		mutex_unlock(&disconnect_mutex);

		return -ENODEV;

	}



	dev->fb_count++;
@@ -1096,6 +1102,8 @@ static int ufx_ops_open(struct fb_info *info, int user) 
	pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",

		info->node, user, info, dev->fb_count);



	mutex_unlock(&disconnect_mutex);



	return 0;

}
@@ -1741,6 +1749,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) 
{

	struct ufx_data *dev;



	mutex_lock(&disconnect_mutex);



	dev = usb_get_intfdata(interface);



	pr_debug("USB disconnect starting\n");
@@ -1761,6 +1771,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) 
	kref_put(&dev->kref, ufx_free);



	/* consider ufx_data freed */



	mutex_unlock(&disconnect_mutex);

}



static struct usb_driver ufx_driver = {