NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
8,036 Commits 59 Branches 0 Tags 1.5 GiB
C 97.1%
Assembly 1.6%
C++ 0.6%
Makefile 0.3%
Perl 0.1%
Go to file
Zheyu Ma 927bb971a7 firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 
[ Upstream commit 829933ef05a951c8ff140e814656d73e74915faf ]

For each device, the nosy driver allocates a pcilynx structure.
A use-after-free might happen in the following scenario:

 1. Open nosy device for the first time and call ioctl with command
    NOSY_IOC_START, then a new client A will be malloced and added to
    doubly linked list.
 2. Open nosy device for the second time and call ioctl with command
    NOSY_IOC_START, then a new client B will be malloced and added to
    doubly linked list.
 3. Call ioctl with command NOSY_IOC_START for client A, then client A
    will be readded to the doubly linked list. Now the doubly linked
    list is messed up.
 4. Close the first nosy device and nosy_release will be called. In
    nosy_release, client A will be unlinked and freed.
 5. Close the second nosy device, and client A will be referenced,
    resulting in UAF.

The root cause of this bug is that the element in the doubly linked list
is reentered into the list.

Fix this bug by adding a check before inserting a client.  If a client
is already in the linked list, don't insert it.

The following KASAN report reveals it:

   BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210
   Write of size 8 at addr ffff888102ad7360 by task poc
   CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6
   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
   Call Trace:
     nosy_release+0x1ea/0x210
     __fput+0x1e2/0x840
     task_work_run+0xe8/0x180
     exit_to_user_mode_prepare+0x114/0x120
     syscall_exit_to_user_mode+0x1d/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

   Allocated by task 337:
     nosy_open+0x154/0x4d0
     misc_open+0x2ec/0x410
     chrdev_open+0x20d/0x5a0
     do_dentry_open+0x40f/0xe80
     path_openat+0x1cf9/0x37b0
     do_filp_open+0x16d/0x390
     do_sys_openat2+0x11d/0x360
     __x64_sys_open+0xfd/0x1a0
     do_syscall_64+0x33/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

   Freed by task 337:
     kfree+0x8f/0x210
     nosy_release+0x158/0x210
     __fput+0x1e2/0x840
     task_work_run+0xe8/0x180
     exit_to_user_mode_prepare+0x114/0x120
     syscall_exit_to_user_mode+0x1d/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

   The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128
   The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380)

[ Modified to use 'list_empty()' inside proper lock  - Linus ]

Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/
Reported-and-tested-by: 马哲宇 (Zheyu Ma) <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-05-20 16:06:50 +08:00
Documentation Intel:PCI/DPC: Add "pcie_ports=dpc-native" to allow DPC without AER control 2021-04-25 14:31:13 +08:00
LICENSES Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
arch xtensa: move coprocessor_flush to the .text section 2021-05-20 16:06:49 +08:00
block block: recalculate segment count for multi-segment discards correctly 2021-04-12 12:53:31 +08:00
certs certs: Fix blacklist flag type confusion 2021-04-12 12:52:25 +08:00
crypto crypto: x86 - Regularize glue function prototypes 2021-04-12 12:53:14 +08:00
drivers firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-05-20 16:06:50 +08:00
fs reiserfs: update reiserfs_xattrs_initialized() condition 2021-05-20 16:06:50 +08:00
include extcon: Add stubs for extcon_register_notifier_all() functions 2021-05-20 16:06:50 +08:00
init fgraph: Initialize tracing_graph_pause at task creation 2021-04-12 12:51:55 +08:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2021-03-16 16:27:51 +08:00
kernel tracing: Fix stack trace event size 2021-05-20 16:06:49 +08:00
lib PCI: Fix pci_register_io_range() memory leak 2021-04-12 12:53:04 +08:00
mm mm: fix race by making init_zero_pfn() early_initcall 2021-05-20 16:06:49 +08:00
net bpf: Remove MTU check in __bpf_skb_max_len 2021-05-20 16:06:48 +08:00
package net: open CONFIG_XFRM_OFFLOAD for x86 public 2021-05-18 07:22:15 +00:00
samples samples, bpf: Add missing munmap in xdpsock 2021-04-12 12:52:57 +08:00
scripts ftrace: Have recordmcount use w8 to read relp->r_info in arm64_is_fake_mcount 2021-04-12 12:52:52 +08:00
security integrity: double check iint_cache was initialized 2021-04-12 12:53:26 +08:00
sound ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook 2021-05-20 16:06:49 +08:00
tools flow_dissector: fix TTL and TOS dissection on IPv4 fragments 2021-05-20 16:06:47 +08:00
usr Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
virt KVM: arm64: Ensure I-cache isolation between vcpus of a same VM 2021-04-12 12:53:12 +08:00
.clang-format Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.cocciconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.get_maintainer.ignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitattributes Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
COPYING Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
CREDITS Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kbuild Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2021-03-16 16:34:24 +08:00
Makefile Rebase to linux long term 5.4.109 2021-04-12 12:53:32 +08:00
README Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
README.md Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
backport_remove_lists.txt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tools_key.pub Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00

README.md

Tencent Linux Kernel 4.0