| Message ID | 20221013131209.775969-1-yangyingliang@huawei.com |
|---|---|
| State | New |
| Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org>
Delivered-To: ouuuleilei@gmail.com
Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp274722wrs;
Thu, 13 Oct 2022 06:19:45 -0700 (PDT)
X-Google-Smtp-Source:
AMsMyM4OdqS0lQ702ZrkbbxdNnF2ofHa8QlYt1WbIuheM2K4ct3la6POFSmqbHrpOD993XVLdfeM
X-Received: by 2002:a17:906:4bd3:b0:731:3bdf:b95c with SMTP id
x19-20020a1709064bd300b007313bdfb95cmr26484911ejv.677.1665667185251;
Thu, 13 Oct 2022 06:19:45 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1665667185; cv=none;
d=google.com; s=arc-20160816;
b=rDqBBGKyhy70Ucxvmq8iOPwWwgSCzuY03VNosjTU3RgCllGpbUHrNapSI1ht+glGpA
yPCmDwu0Pnk5PcQfYO/ea80v4gkKAF3Q88PG/s09jxngdvIJK6zurNquKHdgMAD04mmq
mooeBp4UcLGevPzP4fh8FLQ+jPTM5XvutDcRLvcIoYVoKUZT4VZLmZIDLFxAoQaIonX1
H4IgqbSAVmeDdTvQMy86YjOcmwmWiXmMzsLyoc5sCO+S6zodSsagUf7tBSTTy95vk5D7
AXU0AaAUN1zyQm1S0DIvQ4bv8xuXUkKwtm8SFtkmTqi2mba3ZLU2wvIqq/RUcQ1z2geL
BZBw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=list-id:precedence:content-transfer-encoding:mime-version
:message-id:date:subject:cc:to:from;
bh=fOHB/G8cGU9YezJzpmNjkQ3Xckb0uSZC5y2uKn1T4Ek=;
b=jDAoNJUz38uyQKVHN6ZxKiTL3xZCMKZoOYOMudHShnqpeA+cEFYStc0tAWYPjt0ESs
UVleku3I3sCFEm+xDqPbndivtBYgiYWt4VmQhCVQX17uSVdI3RJ/uAyX5j6R0V5UzSl8
JLC1049SvRb1Ci6Jmgf+WEFIeD2yNiDdhI9MDXRZ37i5+hRXj8osV8XPBV5s+t0qyFSE
tzs6BXoEmL4LB9RcFrYSXtIqsgEmMtVGeWClJ22NOy6+TbxieRvnBIpC699kaZxxjgOJ
+7hA48zzLLmLy9YHLR/y77dd0F389NJLGB4DbV71TZ62Z+aB3B3ieByao7mtmRX7zZoX
JQkw==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com
Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20])
by mx.google.com with ESMTP id
l5-20020a170906a40500b0078a891e407dsi15025022ejz.974.2022.10.13.06.19.19;
Thu, 13 Oct 2022 06:19:45 -0700 (PDT)
Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
client-ip=2620:137:e000::1:20;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S229867AbiJMNMy (ORCPT <rfc822;ouuuleilei@gmail.com> + 99 others);
Thu, 13 Oct 2022 09:12:54 -0400
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48696 "EHLO
lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S229852AbiJMNMv (ORCPT
<rfc822;linux-kernel@vger.kernel.org>);
Thu, 13 Oct 2022 09:12:51 -0400
Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187])
by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A786914D8D8
for <linux-kernel@vger.kernel.org>;
Thu, 13 Oct 2022 06:12:47 -0700 (PDT)
Received: from dggpemm500023.china.huawei.com (unknown [172.30.72.54])
by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4Mp8vr6jCmzmVBT;
Thu, 13 Oct 2022 21:08:08 +0800 (CST)
Received: from dggpemm500007.china.huawei.com (7.185.36.183) by
dggpemm500023.china.huawei.com (7.185.36.83) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2375.31; Thu, 13 Oct 2022 21:12:45 +0800
Received: from huawei.com (10.175.103.91) by dggpemm500007.china.huawei.com
(7.185.36.183) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 13 Oct
2022 21:12:44 +0800
From: Yang Yingliang <yangyingliang@huawei.com>
To: <linux-kernel@vger.kernel.org>
CC: <lvjianmin@loongson.cn>, <chenhuacai@kernel.org>,
<chenhuacai@loongson.cn>
Subject: [PATCH] platform/loongarch: laptop: fix possible UAF in
generic_acpi_laptop_init()
Date: Thu, 13 Oct 2022 21:12:09 +0800
Message-ID: <20221013131209.775969-1-yangyingliang@huawei.com>
X-Mailer: git-send-email 2.25.1
MIME-Version: 1.0
Content-Transfer-Encoding: 7BIT
Content-Type: text/plain; charset=US-ASCII
X-Originating-IP: [10.175.103.91]
X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To
dggpemm500007.china.huawei.com (7.185.36.183)
X-CFilter-Loop: Reflected
X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED,
SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?=
X-GMAIL-THRID: =?utf-8?q?1746578634393128050?=
X-GMAIL-MSGID: =?utf-8?q?1746578634393128050?=
|
| Series |
platform/loongarch: laptop: fix possible UAF in generic_acpi_laptop_init()
|
|
Commit Message
Yang Yingliang
Oct. 13, 2022, 1:12 p.m. UTC
Current the return value of 'sub_driver->init' is not checked,
if sparse_keymap_setup() called in the init function fails,
'generic_inputdev' is freed, then it willl lead a UAF when
using it in generic_acpi_laptop_init(). Fix it by checking
return value. Set generic_inputdev to NULL after free to avoid
double free it.
Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/platform/loongarch/loongson-laptop.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
Comments
Hi, Yingliang, Thank you for your patches, but could you please merge the two trivial patches to a single one? Huacai On Thu, Oct 13, 2022 at 9:12 PM Yang Yingliang <yangyingliang@huawei.com> wrote: > > Current the return value of 'sub_driver->init' is not checked, > if sparse_keymap_setup() called in the init function fails, > 'generic_inputdev' is freed, then it willl lead a UAF when > using it in generic_acpi_laptop_init(). Fix it by checking > return value. Set generic_inputdev to NULL after free to avoid > double free it. > > Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > --- > drivers/platform/loongarch/loongson-laptop.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/platform/loongarch/loongson-laptop.c b/drivers/platform/loongarch/loongson-laptop.c > index f0166ad5d2c2..a665fd1042ac 100644 > --- a/drivers/platform/loongarch/loongson-laptop.c > +++ b/drivers/platform/loongarch/loongson-laptop.c > @@ -448,6 +448,7 @@ static int __init event_init(struct generic_sub_driver *sub_driver) > if (ret < 0) { > pr_err("Failed to setup input device keymap\n"); > input_free_device(generic_inputdev); > + generic_inputdev = NULL; > > return ret; > } > @@ -502,8 +503,11 @@ static int __init generic_subdriver_init(struct generic_sub_driver *sub_driver) > if (ret) > return -EINVAL; > > - if (sub_driver->init) > - sub_driver->init(sub_driver); > + if (sub_driver->init) { > + ret = sub_driver->init(sub_driver); > + if (ret) > + goto err_out; > + } > > if (sub_driver->notify) { > ret = setup_acpi_notify(sub_driver); > -- > 2.25.1 >
Hi, Huacai On 2022/10/13 23:47, Huacai Chen wrote: > Hi, Yingliang, > > Thank you for your patches, but could you please merge the two trivial > patches to a single one? It's OK to merge them into a single one in v2. But the two patches solved different things, they are not relative. Thanks, Yang > > Huacai > > On Thu, Oct 13, 2022 at 9:12 PM Yang Yingliang <yangyingliang@huawei.com> wrote: >> Current the return value of 'sub_driver->init' is not checked, >> if sparse_keymap_setup() called in the init function fails, >> 'generic_inputdev' is freed, then it willl lead a UAF when >> using it in generic_acpi_laptop_init(). Fix it by checking >> return value. Set generic_inputdev to NULL after free to avoid >> double free it. >> >> Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver") >> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> >> --- >> drivers/platform/loongarch/loongson-laptop.c | 8 ++++++-- >> 1 file changed, 6 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/platform/loongarch/loongson-laptop.c b/drivers/platform/loongarch/loongson-laptop.c >> index f0166ad5d2c2..a665fd1042ac 100644 >> --- a/drivers/platform/loongarch/loongson-laptop.c >> +++ b/drivers/platform/loongarch/loongson-laptop.c >> @@ -448,6 +448,7 @@ static int __init event_init(struct generic_sub_driver *sub_driver) >> if (ret < 0) { >> pr_err("Failed to setup input device keymap\n"); >> input_free_device(generic_inputdev); >> + generic_inputdev = NULL; >> >> return ret; >> } >> @@ -502,8 +503,11 @@ static int __init generic_subdriver_init(struct generic_sub_driver *sub_driver) >> if (ret) >> return -EINVAL; >> >> - if (sub_driver->init) >> - sub_driver->init(sub_driver); >> + if (sub_driver->init) { >> + ret = sub_driver->init(sub_driver); >> + if (ret) >> + goto err_out; >> + } >> >> if (sub_driver->notify) { >> ret = setup_acpi_notify(sub_driver); >> -- >> 2.25.1 >> > .
On Fri, Oct 14, 2022 at 9:23 AM Yang Yingliang <yangyingliang@huawei.com> wrote: > > Hi, Huacai > > On 2022/10/13 23:47, Huacai Chen wrote: > > Hi, Yingliang, > > > > Thank you for your patches, but could you please merge the two trivial > > patches to a single one? > It's OK to merge them into a single one in v2. > But the two patches solved different things, they are not relative. You can title it with "Simplify and improve generic_subdriver_init()" or so. Huacai > > Thanks, > Yang > > > > Huacai > > > > On Thu, Oct 13, 2022 at 9:12 PM Yang Yingliang <yangyingliang@huawei.com> wrote: > >> Current the return value of 'sub_driver->init' is not checked, > >> if sparse_keymap_setup() called in the init function fails, > >> 'generic_inputdev' is freed, then it willl lead a UAF when > >> using it in generic_acpi_laptop_init(). Fix it by checking > >> return value. Set generic_inputdev to NULL after free to avoid > >> double free it. > >> > >> Fixes: 6246ed09111f ("LoongArch: Add ACPI-based generic laptop driver") > >> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > >> --- > >> drivers/platform/loongarch/loongson-laptop.c | 8 ++++++-- > >> 1 file changed, 6 insertions(+), 2 deletions(-) > >> > >> diff --git a/drivers/platform/loongarch/loongson-laptop.c b/drivers/platform/loongarch/loongson-laptop.c > >> index f0166ad5d2c2..a665fd1042ac 100644 > >> --- a/drivers/platform/loongarch/loongson-laptop.c > >> +++ b/drivers/platform/loongarch/loongson-laptop.c > >> @@ -448,6 +448,7 @@ static int __init event_init(struct generic_sub_driver *sub_driver) > >> if (ret < 0) { > >> pr_err("Failed to setup input device keymap\n"); > >> input_free_device(generic_inputdev); > >> + generic_inputdev = NULL; > >> > >> return ret; > >> } > >> @@ -502,8 +503,11 @@ static int __init generic_subdriver_init(struct generic_sub_driver *sub_driver) > >> if (ret) > >> return -EINVAL; > >> > >> - if (sub_driver->init) > >> - sub_driver->init(sub_driver); > >> + if (sub_driver->init) { > >> + ret = sub_driver->init(sub_driver); > >> + if (ret) > >> + goto err_out; > >> + } > >> > >> if (sub_driver->notify) { > >> ret = setup_acpi_notify(sub_driver); > >> -- > >> 2.25.1 > >> > > .
diff --git a/drivers/platform/loongarch/loongson-laptop.c b/drivers/platform/loongarch/loongson-laptop.c index f0166ad5d2c2..a665fd1042ac 100644 --- a/drivers/platform/loongarch/loongson-laptop.c +++ b/drivers/platform/loongarch/loongson-laptop.c @@ -448,6 +448,7 @@ static int __init event_init(struct generic_sub_driver *sub_driver) if (ret < 0) { pr_err("Failed to setup input device keymap\n"); input_free_device(generic_inputdev); + generic_inputdev = NULL; return ret; } @@ -502,8 +503,11 @@ static int __init generic_subdriver_init(struct generic_sub_driver *sub_driver) if (ret) return -EINVAL; - if (sub_driver->init) - sub_driver->init(sub_driver); + if (sub_driver->init) { + ret = sub_driver->init(sub_driver); + if (ret) + goto err_out; + } if (sub_driver->notify) { ret = setup_acpi_notify(sub_driver);