efi: capsule-loader: Fix use-after-free in efi_capsule_write
PATCH v3 1/1 efi: capsule-loader: Fix use-after-free in efi_capsule_write
A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule.
This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops,
which ultimately results in UAF.
So I added mutex_lock/unlock to these two functions to avoid race condition.
Signed-off-by Hyunwoo Kim <[email protected]>
--- drivers/firmware/efi/capsule-loader.c | 12 ++++++++++++ include/linux/efi.h | 1 + 2 files changed, 13 insertions(+)
drivers/firmware/efi/capsule-loader.c +12 -0
@@ -174,6 +174,8 @@ static ssize_t efi_capsule_write(struct file *file, const char __user *buff,void *kbuff =NULL ;size_t write_byte; +mutex_lock (&cap_info->write_lock); +if (count ==0 )return 0 ;
@@ -233,12 +235,16 @@ static ssize_t efi_capsule_write(struct file *file, const char __user *buff, goto failed; } +mutex_unlock (&cap_info->write_lock); +return write_byte; fail_unmap:kunmap (page); failed:efi_free_all_buff_pages (cap_info); +mutex_unlock (&cap_info->write_lock); +return ret; }
@@ -256,12 +262,16 @@ static int efi_capsule_flush(struct file *file, fl_owner_t id)int ret =0 ;struct capsule_info *cap_info = file->private_data; +mutex_lock (&cap_info->write_lock); +if (cap_info->index >0 ) {pr_err ("capsule upload not complete\n" );efi_free_all_buff_pages (cap_info); ret = -ECANCELED ; } +mutex_unlock (&cap_info->write_lock); +return ret; }
@@ -315,6 +325,8 @@ static int efi_capsule_open(struct inode *inode, struct file *file)return -ENOMEM ; } +mutex_init (&cap_info->write_lock); + file->private_data = cap_info;return 0 ;
include/linux/efi.h +1 -0
@@ -204,6 +204,7 @@ struct efi_image_auth {struct capsule_info {efi_capsule_header_t header;efi_capsule_header_t *capsule; +struct mutex write_lock;int reset_type;long index;size_t count;
Signature · 9 lines
2.25.1 Fixed a typo in the v2 patch "struct mutex write_mutex". ah... I had a problem with my mutt client. Sent back with v3 patch. Sorry. Regards, Hyunwoo Kim.