Skip to contentSkip to conversation

video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

PATCH Applied Hyunwoo Kim 2 participants 3 messages Sep 25, 2022 – Sep 26, 2022

Subsystems (2)
Framebuffer layer Smsc UFX6000 and UFX7000 USB to vga driver
lore
Share & tools
lore

Hyunwoo Kim

author
#0 lore raw

PATCH v3 1/1 video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

A race condition may occur if the user physically removes the USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs.

Signed-off-by Hyunwoo Kim <[email protected]>
---
 drivers/video/fbdev/smscufx.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/video/fbdev/smscufx.c +13 -1
index d7aa5511c361..e65bdc499c23 100644
@@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len);
 static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);
 static void ufx_free_urb_list(struct ufx_data *dev);
 
+static DEFINE_MUTEX(disconnect_mutex);
+
 /* reads a control register */
 static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)
 {

@@ -1071,9 +1073,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
 	if (user == 0 && !console)
 		return -EBUSY;
 
+	mutex_lock(&disconnect_mutex);
+
 	/* If the USB device is gone, we don't accept new opens */
-	if (dev->virtualized)
+	if (dev->virtualized) {
+		mutex_unlock(&disconnect_mutex);
 		return -ENODEV;
+	}
 
 	dev->fb_count++;
 

@@ -1097,6 +1103,8 @@ static int ufx_ops_open(struct fb_info *info, int user)
 	pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
 		info->node, user, info, dev->fb_count);
 
+	mutex_unlock(&disconnect_mutex);
+
 	return 0;
 }
 

@@ -1741,6 +1749,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
 {
 	struct ufx_data *dev;
 
+	mutex_lock(&disconnect_mutex);
+
 	dev = usb_get_intfdata(interface);
 
 	pr_debug("USB disconnect starting\n");

@@ -1761,6 +1771,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
 	kref_put(&dev->kref, ufx_free);
 
 	/* consider ufx_data freed */
+
+	mutex_unlock(&disconnect_mutex);
 }
 
 static struct usb_driver ufx_driver = {
Signature · 1 line
2.25.1
maintainer Applied
#1 lore raw
Quoted 10 lines · Hyunwoo Kim

A race condition may occur if the user physically removes the USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs.

Signed-off-by Hyunwoo Kim <[email protected]>

applied.

Thanks!
Helge

author
#2 lore raw

Thank you for your review.

Best Regards,
Hyunwoo Kim.