Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54f7358b authored by Tzung-Bi Shih's avatar Tzung-Bi Shih Committed by Greg Kroah-Hartman
Browse files

platform/chrome: cros_ec_debugfs: detach log reader wq from devm 



[ Upstream commit 0e8eb5e8acbad19ac2e1856b2fb2320184299b33 ]

Debugfs console_log uses devm memory (e.g. debug_info in
cros_ec_console_log_poll()).  However, lifecycles of device and debugfs
are independent.  An use-after-free issue is observed if userland
program operates the debugfs after the memory has been freed.

The call trace:
 do_raw_spin_lock
 _raw_spin_lock_irqsave
 remove_wait_queue
 ep_unregister_pollwait
 ep_remove
 do_epoll_ctl

A Python example to reproduce the issue:
... import select
... p = select.epoll()
... f = open('/sys/kernel/debug/cros_scp/console_log')
... p.register(f, select.POLLIN)
... p.poll(1)
[(4, 1)]                    # 4=fd, 1=select.POLLIN

[ shutdown cros_scp at the point ]

... p.poll(1)
[(4, 16)]                   # 4=fd, 16=select.POLLHUP
... p.unregister(f)

An use-after-free issue raises here.  It called epoll_ctl with
EPOLL_CTL_DEL which in turn to use the workqueue in the devm (i.e.
log_wq).

Detaches log reader's workqueue from devm to make sure it is persistent
even if the device has been removed.

Signed-off-by: default avatarTzung-Bi Shih <tzungbi@google.com>
Reviewed-by: default avatarGuenter Roeck <groeck@google.com>
Link: https://lore.kernel.org/r/20220209051130.386175-1-tzungbi@google.com


Signed-off-by: default avatarBenson Leung <bleung@chromium.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 232128f6

drivers/platform/chrome/cros_ec_debugfs.c

+6 −6
Original line number Diff line number Diff line
@@ -26,6 +26,9 @@ 


#define CIRC_ADD(idx, size, value)	(((idx) + (value)) & ((size) - 1))



/* waitqueue for log readers */

static DECLARE_WAIT_QUEUE_HEAD(cros_ec_debugfs_log_wq);



/**

 * struct cros_ec_debugfs - EC debugging information.

 *
@@ -34,7 +37,6 @@ 
 * @log_buffer: circular buffer for console log information

 * @read_msg: preallocated EC command and buffer to read console log

 * @log_mutex: mutex to protect circular buffer

 * @log_wq: waitqueue for log readers

 * @log_poll_work: recurring task to poll EC for new console log data

 * @panicinfo_blob: panicinfo debugfs blob

 */
@@ -45,7 +47,6 @@ struct cros_ec_debugfs { 
	struct circ_buf log_buffer;

	struct cros_ec_command *read_msg;

	struct mutex log_mutex;

	wait_queue_head_t log_wq;

	struct delayed_work log_poll_work;

	/* EC panicinfo */

	struct debugfs_blob_wrapper panicinfo_blob;
@@ -108,7 +109,7 @@ static void cros_ec_console_log_work(struct work_struct *__work) 
			buf_space--;

		}



		wake_up(&debug_info->log_wq);

		wake_up(&cros_ec_debugfs_log_wq);

	}



	mutex_unlock(&debug_info->log_mutex);
@@ -142,7 +143,7 @@ static ssize_t cros_ec_console_log_read(struct file *file, char __user *buf, 


		mutex_unlock(&debug_info->log_mutex);



		ret = wait_event_interruptible(debug_info->log_wq,

		ret = wait_event_interruptible(cros_ec_debugfs_log_wq,

					CIRC_CNT(cb->head, cb->tail, LOG_SIZE));

		if (ret < 0)

			return ret;
@@ -174,7 +175,7 @@ static __poll_t cros_ec_console_log_poll(struct file *file, 
	struct cros_ec_debugfs *debug_info = file->private_data;

	__poll_t mask = 0;



	poll_wait(file, &debug_info->log_wq, wait);

	poll_wait(file, &cros_ec_debugfs_log_wq, wait);



	mutex_lock(&debug_info->log_mutex);

	if (CIRC_CNT(debug_info->log_buffer.head,
@@ -359,7 +360,6 @@ static int cros_ec_create_console_log(struct cros_ec_debugfs *debug_info) 
	debug_info->log_buffer.tail = 0;



	mutex_init(&debug_info->log_mutex);

	init_waitqueue_head(&debug_info->log_wq);



	debugfs_create_file("console_log", S_IFREG | 0444, debug_info->dir,

			    debug_info, &cros_ec_console_log_fops);