driver: base: fix UAF when driver_attach failed
PATCH 1/1 driver: base: fix UAF when driver_attach failed
When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF.
To fix it, we need to delete it from the bus when failed.
--- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/bus.c +3 -1
@@ -617,7 +617,7 @@ int bus_add_driver(struct device_driver *drv)if (drv->bus->p->drivers_autoprobe) { error =driver_attach (drv);if (error) - goto out_unregister; + goto out_del_list; }module_add_driver (drv->owner, drv);
@@ -644,6 +644,8 @@ int bus_add_driver(struct device_driver *drv)return 0 ; +out_del_list: +klist_del (&priv->knode_bus); out_unregister:kobject_put (&priv->kobj);/* drv->p is freed in driver_release() */
Signature · 1 line
2.29.0
Greg KH
maintainerQuoted 8 lines · Schspa Shi
When
driver_attach(drv); failed, thedriver_privatewill be freed. But it has been added to the bus, which caused a UAF.To fix it, we need to delete it from the bus when failed.
Fixes 190888ac01d0 ("driver core: fix possible missing of device probe")Signed-off-by Schspa Shi <[email protected]>
No blank line needed after fixes:
Quoted 18 lines
--- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/base/bus.c +1
-1@@ -617,7 +617,7 @@ int bus_add_driver(struct device_driver *drv)if (drv->bus->p->drivers_autoprobe) { error =driver_attach (drv);if (error) - goto out_unregister; + goto out_del_list; }module_add_driver (drv->owner, drv);
drivers/base/bus.c int bus_add_driver(struct device_driver *drv) · line 648
Quoted 5 lines
drivers/base/bus.c +2
-0@@ -644,6 +644,8 @@ int bus_add_driver(struct device_driver *drv)return 0 ; +out_del_list: +klist_del (&priv->knode_bus);
Odd, how did you find this? Has this ever been triggered by any real-world situations?
thanks,
greg k-h
Quoted 4 lines · Greg KH
Quoted 3 lines · Schspa Shi
When
driver_attach(drv); failed, thedriver_privatewill be freed. But it has been added to the bus, which caused a UAF.
Quoted 8 lines
Quoted 5 lines
To fix it, we need to delete it from the bus when failed.
Fixes 190888ac01d0 ("driver core: fix possible missing of device probe")Signed-off-by Schspa Shi <[email protected]>No blank line needed after fixes:
Do I need a new patch version for this ?
Quoted 19 lines
Quoted 19 lines
--- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/base/bus.c +1
-1@@ -617,7 +617,7 @@ int bus_add_driver(struct device_driver *drv)if (drv->bus->p->drivers_autoprobe) { error =driver_attach (drv);if (error) - goto out_unregister; + goto out_del_list; }module_add_driver (drv->owner, drv);@@ -644,6 +644,8 @@ int bus_add_driver(struct device_driver *drv)
Quoted 8 lines
drivers/base/bus.c int bus_add_driver(struct device_driver *drv) · line 648
Quoted 4 lines
drivers/base/bus.c +2
-0return 0 ; +out_del_list: +klist_del (&priv->knode_bus);Odd, how did you find this? Has this ever been triggered by any real-world situations?
I found this when fixing this issue via code review.
It shouldn't not happen, unless the bus driver's match() return value < 0. Which never happens with the existing bus drivers.
Quoted 3 lines
thanks,
greg k-h
---
BRs
Schspa Shi