Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a93e7b33 authored by Hamish Martin's avatar Hamish Martin Committed by Greg Kroah-Hartman
Browse files

uio: Prevent device destruction while fds are open 



Prevent destruction of a uio_device while user space apps hold open
file descriptors to that device. Further, access to the 'info' member
of the struct uio_device is protected by spinlock. This is to ensure
stale pointers to data not under control of the UIO subsystem are not
dereferenced.

Signed-off-by: default avatarHamish Martin <hamish.martin@alliedtelesis.co.nz>
Reviewed-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 81daa406

drivers/uio/uio.c

+72 −26
Original line number Diff line number Diff line
@@ -270,7 +270,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) 
		if (!map_found) {

			map_found = 1;

			idev->map_dir = kobject_create_and_add("maps",

							&idev->dev->kobj);

							&idev->dev.kobj);

			if (!idev->map_dir) {

				ret = -ENOMEM;

				goto err_map;
@@ -299,7 +299,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) 
		if (!portio_found) {

			portio_found = 1;

			idev->portio_dir = kobject_create_and_add("portio",

							&idev->dev->kobj);

							&idev->dev.kobj);

			if (!idev->portio_dir) {

				ret = -ENOMEM;

				goto err_portio;
@@ -342,7 +342,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) 
		kobject_put(&map->kobj);

	}

	kobject_put(idev->map_dir);

	dev_err(idev->dev, "error creating sysfs files (%d)\n", ret);

	dev_err(&idev->dev, "error creating sysfs files (%d)\n", ret);

	return ret;

}
@@ -379,7 +379,7 @@ static int uio_get_minor(struct uio_device *idev) 
		idev->minor = retval;

		retval = 0;

	} else if (retval == -ENOSPC) {

		dev_err(idev->dev, "too many uio devices\n");

		dev_err(&idev->dev, "too many uio devices\n");

		retval = -EINVAL;

	}

	mutex_unlock(&minor_lock);
@@ -433,6 +433,7 @@ static int uio_open(struct inode *inode, struct file *filep) 
	struct uio_device *idev;

	struct uio_listener *listener;

	int ret = 0;

	unsigned long flags;



	mutex_lock(&minor_lock);

	idev = idr_find(&uio_idr, iminor(inode));
@@ -442,9 +443,11 @@ static int uio_open(struct inode *inode, struct file *filep) 
		goto out;

	}



	get_device(&idev->dev);



	if (!try_module_get(idev->owner)) {

		ret = -ENODEV;

		goto out;

		goto err_module_get;

	}



	listener = kmalloc(sizeof(*listener), GFP_KERNEL);
@@ -457,11 +460,13 @@ static int uio_open(struct inode *inode, struct file *filep) 
	listener->event_count = atomic_read(&idev->event);

	filep->private_data = listener;



	if (idev->info->open) {

	spin_lock_irqsave(&idev->info_lock, flags);

	if (idev->info && idev->info->open)

		ret = idev->info->open(idev->info, inode);

	spin_unlock_irqrestore(&idev->info_lock, flags);

	if (ret)

		goto err_infoopen;

	}



	return 0;



err_infoopen:
@@ -470,6 +475,9 @@ static int uio_open(struct inode *inode, struct file *filep) 
err_alloc_listener:

	module_put(idev->owner);



err_module_get:

	put_device(&idev->dev);



out:

	return ret;

}
@@ -487,12 +495,16 @@ static int uio_release(struct inode *inode, struct file *filep) 
	int ret = 0;

	struct uio_listener *listener = filep->private_data;

	struct uio_device *idev = listener->dev;

	unsigned long flags;



	if (idev->info->release)

	spin_lock_irqsave(&idev->info_lock, flags);

	if (idev->info && idev->info->release)

		ret = idev->info->release(idev->info, inode);

	spin_unlock_irqrestore(&idev->info_lock, flags);



	module_put(idev->owner);

	kfree(listener);

	put_device(&idev->dev);

	return ret;

}
@@ -500,9 +512,16 @@ static __poll_t uio_poll(struct file *filep, poll_table *wait) 
{

	struct uio_listener *listener = filep->private_data;

	struct uio_device *idev = listener->dev;

	__poll_t ret = 0;

	unsigned long flags;



	if (!idev->info->irq)

		return -EIO;

	spin_lock_irqsave(&idev->info_lock, flags);

	if (!idev->info || !idev->info->irq)

		ret = -EIO;

	spin_unlock_irqrestore(&idev->info_lock, flags);



	if (ret)

		return ret;



	poll_wait(filep, &idev->wait, wait);

	if (listener->event_count != atomic_read(&idev->event))
@@ -516,11 +535,17 @@ static ssize_t uio_read(struct file *filep, char __user *buf, 
	struct uio_listener *listener = filep->private_data;

	struct uio_device *idev = listener->dev;

	DECLARE_WAITQUEUE(wait, current);

	ssize_t retval;

	ssize_t retval = 0;

	s32 event_count;

	unsigned long flags;



	if (!idev->info->irq)

		return -EIO;

	spin_lock_irqsave(&idev->info_lock, flags);

	if (!idev->info || !idev->info->irq)

		retval = -EIO;

	spin_unlock_irqrestore(&idev->info_lock, flags);



	if (retval)

		return retval;



	if (count != sizeof(s32))

		return -EINVAL;
@@ -567,8 +592,10 @@ static ssize_t uio_write(struct file *filep, const char __user *buf, 
	struct uio_device *idev = listener->dev;

	ssize_t retval;

	s32 irq_on;

	unsigned long flags;



	if (!idev->info->irq) {

	spin_lock_irqsave(&idev->info_lock, flags);

	if (!idev->info || !idev->info->irq) {

		retval = -EIO;

		goto out;

	}
@@ -591,6 +618,7 @@ static ssize_t uio_write(struct file *filep, const char __user *buf, 
	retval = idev->info->irqcontrol(idev->info, irq_on);



out:

	spin_unlock_irqrestore(&idev->info_lock, flags);

	return retval ? retval : sizeof(s32);

}
@@ -803,6 +831,13 @@ static void release_uio_class(void) 
	uio_major_cleanup();

}



static void uio_device_release(struct device *dev)

{

	struct uio_device *idev = dev_get_drvdata(dev);



	kfree(idev);

}



/**

 * uio_register_device - register a new userspace IO device

 * @owner:	module that creates the new device
@@ -823,13 +858,14 @@ int __uio_register_device(struct module *owner, 


	info->uio_dev = NULL;



	idev = devm_kzalloc(parent, sizeof(*idev), GFP_KERNEL);

	idev = kzalloc(sizeof(*idev), GFP_KERNEL);

	if (!idev) {

		return -ENOMEM;

	}



	idev->owner = owner;

	idev->info = info;

	spin_lock_init(&idev->info_lock);

	init_waitqueue_head(&idev->wait);

	atomic_set(&idev->event, 0);
@@ -837,14 +873,19 @@ int __uio_register_device(struct module *owner, 
	if (ret)

		return ret;



	idev->dev = device_create(&uio_class, parent,

				  MKDEV(uio_major, idev->minor), idev,

				  "uio%d", idev->minor);

	if (IS_ERR(idev->dev)) {

		printk(KERN_ERR "UIO: device register failed\n");

		ret = PTR_ERR(idev->dev);

	idev->dev.devt = MKDEV(uio_major, idev->minor);

	idev->dev.class = &uio_class;

	idev->dev.parent = parent;

	idev->dev.release = uio_device_release;

	dev_set_drvdata(&idev->dev, idev);



	ret = dev_set_name(&idev->dev, "uio%d", idev->minor);

	if (ret)

		goto err_device_create;



	ret = device_register(&idev->dev);

	if (ret)

		goto err_device_create;

	}



	ret = uio_dev_add_attributes(idev);

	if (ret)
@@ -872,7 +913,7 @@ int __uio_register_device(struct module *owner, 
err_request_irq:

	uio_dev_del_attributes(idev);

err_uio_dev_add_attributes:

	device_destroy(&uio_class, MKDEV(uio_major, idev->minor));

	device_unregister(&idev->dev);

err_device_create:

	uio_free_minor(idev);

	return ret;
@@ -887,6 +928,7 @@ EXPORT_SYMBOL_GPL(__uio_register_device); 
void uio_unregister_device(struct uio_info *info)

{

	struct uio_device *idev;

	unsigned long flags;



	if (!info || !info->uio_dev)

		return;
@@ -900,7 +942,11 @@ void uio_unregister_device(struct uio_info *info) 
	if (info->irq && info->irq != UIO_IRQ_CUSTOM)

		free_irq(info->irq, idev);



	device_destroy(&uio_class, MKDEV(uio_major, idev->minor));

	spin_lock_irqsave(&idev->info_lock, flags);

	idev->info = NULL;

	spin_unlock_irqrestore(&idev->info_lock, flags);



	device_unregister(&idev->dev);



	return;

}

include/linux/uio_driver.h

+3 −1
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#ifndef _UIO_DRIVER_H_

#define _UIO_DRIVER_H_



#include <linux/device.h>

#include <linux/fs.h>

#include <linux/interrupt.h>
@@ -68,12 +69,13 @@ struct uio_port { 


struct uio_device {

        struct module           *owner;

        struct device           *dev;

	struct device		dev;

        int                     minor;

        atomic_t                event;

        struct fasync_struct    *async_queue;

        wait_queue_head_t       wait;

        struct uio_info         *info;

	spinlock_t		info_lock;

        struct kobject          *map_dir;

        struct kobject          *portio_dir;

};