2021-11-04 15:36:10

by YE Chengfeng

[permalink] [raw]
Subject: [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()

&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.

Signed-off-by: Chengfeng Ye <[email protected]>
---
drivers/firewire/core-cdev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 9f89c17730b1..2f47e31918f0 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1516,9 +1516,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
}
e->phy_packet.data[0] = packet->timestamp;

+ struct client *e_client = e->client;
queue_event(e->client, &e->event, &e->phy_packet,
sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
- client_put(e->client);
+ client_put(e_client);
}

static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
--
2.17.1


2021-11-04 21:36:32

by kernel test robot

[permalink] [raw]
Subject: Re: [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()

Hi Chengfeng,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on ieee1394-linux1394/for-next]
[also build test WARNING on v5.15 next-20211104]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url: https://github.com/0day-ci/linux/commits/Chengfeng-Ye/firewire-fix-potential-uaf-in-outbound_phy_packet_callback/20211104-233441
base: https://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394.git for-next
config: x86_64-randconfig-r034-20211105 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 847a6807332b13f43704327c2d30103ec0347c77)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/4374c2eea7055a681ca81f925ded194d11062af6
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Chengfeng-Ye/firewire-fix-potential-uaf-in-outbound_phy_packet_callback/20211104-233441
git checkout 4374c2eea7055a681ca81f925ded194d11062af6
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=x86_64

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>

All warnings (new ones prefixed by >>):

>> drivers/firewire/core-cdev.c:1499:17: warning: ISO C90 forbids mixing declarations and code [-Wdeclaration-after-statement]
struct client *e_client = e->client;
^
1 warning generated.


vim +1499 drivers/firewire/core-cdev.c

1477
1478 static void outbound_phy_packet_callback(struct fw_packet *packet,
1479 struct fw_card *card, int status)
1480 {
1481 struct outbound_phy_packet_event *e =
1482 container_of(packet, struct outbound_phy_packet_event, p);
1483
1484 switch (status) {
1485 /* expected: */
1486 case ACK_COMPLETE: e->phy_packet.rcode = RCODE_COMPLETE; break;
1487 /* should never happen with PHY packets: */
1488 case ACK_PENDING: e->phy_packet.rcode = RCODE_COMPLETE; break;
1489 case ACK_BUSY_X:
1490 case ACK_BUSY_A:
1491 case ACK_BUSY_B: e->phy_packet.rcode = RCODE_BUSY; break;
1492 case ACK_DATA_ERROR: e->phy_packet.rcode = RCODE_DATA_ERROR; break;
1493 case ACK_TYPE_ERROR: e->phy_packet.rcode = RCODE_TYPE_ERROR; break;
1494 /* stale generation; cancelled; on certain controllers: no ack */
1495 default: e->phy_packet.rcode = status; break;
1496 }
1497 e->phy_packet.data[0] = packet->timestamp;
1498
> 1499 struct client *e_client = e->client;
1500 queue_event(e->client, &e->event, &e->phy_packet,
1501 sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
1502 client_put(e_client);
1503 }
1504

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]


Attachments:
(No filename) (3.15 kB)
.config.gz (31.16 kB)
Download all attachments