Commit d3e1e246 authored by Eddie James's avatar Eddie James Committed by Joel Stanley
Browse files

fsi: occ: Prevent use after free 



Use get_device and put_device in the open and close functions to
make sure the device doesn't get freed while a file descriptor is
open.
Also, lock around the freeing of the device buffer and check the
buffer before using it in the submit function.

Signed-off-by: default avatarEddie James <eajames@linux.ibm.com>
Reviewed-by: default avatarGuenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20220513194424.53468-1-eajames@linux.ibm.com


Signed-off-by: default avatarJoel Stanley <joel@jms.id.au>
parent dbed963e

drivers/fsi/fsi-occ.c

+15 −3
Original line number Diff line number Diff line
@@ -94,6 +94,7 @@ static int occ_open(struct inode *inode, struct file *file) 
	client->occ = occ;

	mutex_init(&client->lock);

	file->private_data = client;

	get_device(occ->dev);



	/* We allocate a 1-page buffer, make sure it all fits */

	BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE);
@@ -197,6 +198,7 @@ static int occ_release(struct inode *inode, struct file *file) 
{

	struct occ_client *client = file->private_data;



	put_device(client->occ->dev);

	free_page((unsigned long)client->buffer);

	kfree(client);
@@ -493,12 +495,19 @@ int fsi_occ_submit(struct device *dev, const void *request, size_t req_len, 
	for (i = 1; i < req_len - 2; ++i)

		checksum += byte_request[i];



	mutex_lock(&occ->occ_lock);

	rc = mutex_lock_interruptible(&occ->occ_lock);

	if (rc)

		return rc;



	occ->client_buffer = response;

	occ->client_buffer_size = user_resp_len;

	occ->client_response_size = 0;



	if (!occ->buffer) {

		rc = -ENOENT;

		goto done;

	}



	/*

	 * Get a sequence number and update the counter. Avoid a sequence

	 * number of 0 which would pass the response check below even if the
@@ -674,10 +683,13 @@ static int occ_remove(struct platform_device *pdev) 
{

	struct occ *occ = platform_get_drvdata(pdev);



	kvfree(occ->buffer);



	misc_deregister(&occ->mdev);



	mutex_lock(&occ->occ_lock);

	kvfree(occ->buffer);

	occ->buffer = NULL;

	mutex_unlock(&occ->occ_lock);



	device_for_each_child(&pdev->dev, NULL, occ_unregister_child);



	ida_simple_remove(&occ_ida, occ->idx);