Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3555de57 authored by Muchun Song's avatar Muchun Song Committed by Greg Kroah-Hartman
Browse files

gpiolib: Fix possible use after free on label 



[ Upstream commit 18534df419041e6c1f4b41af56ee7d41f757815c ]

gpiod_request_commit() copies the pointer to the label passed as
an argument only to be used later. But there's a chance the caller
could immediately free the passed string(e.g., local variable).
This could trigger a use after free when we use gpio label(e.g.,
gpiochip_unlock_as_irq(), gpiochip_is_requested()).

To be on the safe side: duplicate the string with kstrdup_const()
so that if an unaware user passes an address to a stack-allocated
buffer, we won't get the arbitrary label.

Also fix gpiod_set_consumer_name().

Signed-off-by: default avatarMuchun Song <smuchun@gmail.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 9e4b0f77

drivers/gpio/gpiolib.c

+21 −4
Original line number Diff line number Diff line
@@ -2279,6 +2279,12 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) 
	unsigned long		flags;

	unsigned		offset;



	if (label) {

		label = kstrdup_const(label, GFP_KERNEL);

		if (!label)

			return -ENOMEM;

	}



	spin_lock_irqsave(&gpio_lock, flags);



	/* NOTE:  gpio_request() can be called in early boot,
@@ -2289,6 +2295,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) 
		desc_set_label(desc, label ? : "?");

		status = 0;

	} else {

		kfree_const(label);

		status = -EBUSY;

		goto done;

	}
@@ -2305,6 +2312,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) 


		if (status < 0) {

			desc_set_label(desc, NULL);

			kfree_const(label);

			clear_bit(FLAG_REQUESTED, &desc->flags);

			goto done;

		}
@@ -2400,6 +2408,7 @@ static bool gpiod_free_commit(struct gpio_desc *desc) 
			chip->free(chip, gpio_chip_hwgpio(desc));

			spin_lock_irqsave(&gpio_lock, flags);

		}

		kfree_const(desc->label);

		desc_set_label(desc, NULL);

		clear_bit(FLAG_ACTIVE_LOW, &desc->flags);

		clear_bit(FLAG_REQUESTED, &desc->flags);
@@ -3221,11 +3230,19 @@ EXPORT_SYMBOL_GPL(gpiod_cansleep); 
 * @desc: gpio to set the consumer name on

 * @name: the new consumer name

 */

void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)

int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)

{

	VALIDATE_DESC_VOID(desc);

	/* Just overwrite whatever the previous name was */

	desc->label = name;

	VALIDATE_DESC(desc);

	if (name) {

		name = kstrdup_const(name, GFP_KERNEL);

		if (!name)

			return -ENOMEM;

	}



	kfree_const(desc->label);

	desc_set_label(desc, name);



	return 0;

}

EXPORT_SYMBOL_GPL(gpiod_set_consumer_name);

include/linux/gpio/consumer.h

+4 −2
Original line number Diff line number Diff line
@@ -142,7 +142,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc); 
int gpiod_cansleep(const struct gpio_desc *desc);



int gpiod_to_irq(const struct gpio_desc *desc);

void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);

int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);



/* Convert between the old gpio_ and new gpiod_ interfaces */

struct gpio_desc *gpio_to_desc(unsigned gpio);
@@ -465,10 +465,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc) 
	return -EINVAL;

}



static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)

static inline int gpiod_set_consumer_name(struct gpio_desc *desc,

					  const char *name)

{

	/* GPIO can never have been requested */

	WARN_ON(1);

	return -EINVAL;

}



static inline struct gpio_desc *gpio_to_desc(unsigned gpio)