| Message ID | 67e074f0c8e538caa2d2cd0eb49936e112249839.1649913521.git.duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Fix double free bugs and UAF bug in nfcmrvl module | expand |
diff --git a/drivers/nfc/nfcmrvl/fw_dnld.c b/drivers/nfc/nfcmrvl/fw_dnld.c index bb9e7e2bdec..910f6eaec65 100644 --- a/drivers/nfc/nfcmrvl/fw_dnld.c +++ b/drivers/nfc/nfcmrvl/fw_dnld.c @@ -511,7 +511,10 @@ int nfcmrvl_fw_dnld_start(struct nci_dev *ndev, const char *firmware_name) return -ENOENT; } - fw_dnld->header = (const struct nfcmrvl_fw *) priv->fw_dnld.fw->data; + spin_lock(&priv->fw_dnld.lock); + if (priv->fw_dnld.fw) + fw_dnld->header = (const struct nfcmrvl_fw *)priv->fw_dnld.fw->data; + spin_unlock(&priv->fw_dnld.lock); if (fw_dnld->header->magic != NFCMRVL_FW_MAGIC || fw_dnld->header->phy != priv->phy) {
There are potential use-after-free bug in nfcmrvl_fw_dnld_start(). The race between nfcmrvl_disconnect() and nfcmrvl_fw_dnld_start() can be shown as below: (USE) | (FREE) | nfcmrvl_disconnect | nfcmrvl_nci_unregister_dev | nfcmrvl_fw_dnld_abort | fw_dnld_over nfcmrvl_fw_dnld_start | release_firmware ... | kfree(fw) //(1) priv->fw_dnld.fw->data //(2)| ... ... | The firmware is deallocate in position (1), but it is used in position (2), which leads to UAF bug. This patch add spin_lock() and check in nfcmrvl_fw_dnld_start() in order to synchronize with other threads that could free firmware. Therefore, the UAF bug could be prevented. Fixes: 3194c6870158e3 ("NFC: nfcmrvl: add firmware download support") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/nfc/nfcmrvl/fw_dnld.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)