From patchwork Thu Dec 1 08:33:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bartosz Golaszewski X-Patchwork-Id: 28233 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp145869wrr; Thu, 1 Dec 2022 00:42:56 -0800 (PST) X-Google-Smtp-Source: AA0mqf7U+NIXj94i2AFtkzr4wSotKIAsn0U/e2Rxshq4dMAlCCloHxeFLI2bLKhzKuqdIVPSoHfn X-Received: by 2002:a17:90a:c78c:b0:213:bbb4:13ce with SMTP id gn12-20020a17090ac78c00b00213bbb413cemr67735669pjb.246.1669884176424; Thu, 01 Dec 2022 00:42:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669884176; cv=none; d=google.com; s=arc-20160816; b=AVECDt++6Hy8Z3v6KlUYDjoAj8zIYPB3mxKwNvRz4WPU1bgAsiG+Wd4cy75ztFegq0 lB9Ay8BxK80qk7BRuiuyv1y2HtYtQmwumtVdsPmSxuc76uA+eq+K8/QXOPPR2/g4DVIa GgCB/gkRXjGZ00DF2Ws3OhQ6570qjejPtPtH1HGGqRa8o4p6opHZmfB6jueg2iHXjJIA aVJqZjpha19Om0dvoTz6ynoWK58dCc3fz+QjU8lDg0KR+aCIXVvUdnsY/WGig4+MetKK REFCXjvirQPKNgVsIIJwz+448FzHra8zdBSJWCENK+4rR5SkQ9FzHQP25iR89CnkR8ZV KD1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=ysZtnS5xnth5w0LemSDO+wCvjLXEmog+vjYaOIZiWJQ=; b=Q32PBHThKCn6KjCtafxqxFHYyHNNesg02gwCIB9VJVoeubv4rB64aO+RQX84LbriZe QwTIn450nRQRUl+doiRd9UW4OsDS5sn/eT49LeqNlxQjPzgnWfIsDEkc216vzkAZ62N5 WYCDZvjkeZUeEScEhShUD9q7x+VMBUbYonfSBP4j9vPtgSNkHpzKFPPEYMuX5zyuY9Jc rjbNfsXdtxFaZE72enE06OUpKLACOzoIJB4gJCsuajnzo1n5NrHD5gyKigbHhqo6cDKo +UirWOvVZRKqypA+x26hxEoBOqGDq1HUnsZSJouv9Hb1dj0AqpwOr5528m/Wu3xNPKsc G3LQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@bgdev-pl.20210112.gappssmtp.com header.s=20210112 header.b=3Oq5Kynt; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x7-20020a170902ec8700b00189aab9cdb8si4194175plg.282.2022.12.01.00.42.43; Thu, 01 Dec 2022 00:42:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@bgdev-pl.20210112.gappssmtp.com header.s=20210112 header.b=3Oq5Kynt; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229516AbiLAIds (ORCPT + 99 others); Thu, 1 Dec 2022 03:33:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36788 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229503AbiLAIdm (ORCPT ); Thu, 1 Dec 2022 03:33:42 -0500 Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1916755CBC for ; Thu, 1 Dec 2022 00:33:41 -0800 (PST) Received: by mail-wr1-x42c.google.com with SMTP id y16so1502688wrm.2 for ; Thu, 01 Dec 2022 00:33:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bgdev-pl.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ysZtnS5xnth5w0LemSDO+wCvjLXEmog+vjYaOIZiWJQ=; b=3Oq5KyntCOkkapW7IuIfrvowfNEYYc39U5mzPk79T2LDNpuz1HKBSTA5SrlHGSdpPL EJpssNAY9oLNWQjRTDDM5LIyAK3UtxTGzk686AV3u6aNOJV5QRK/v9wn9zOMgr9VjXSy InyGEvX3XJQelpGtp+T7a/u7Xkkk17KCMzhr+VTtzpfVhTbAJtYkxg23feh/zpWvDL2s bJNQ6nT22LluncGwNlpVzC0uh+D4ZQ5wTQM/EMKBR1QN6tk1iX0h3I2M+Z1zhkMQjea/ u+B1POZkD9pXYyhn6mgpYYnl976Y3HNjpZyGL+E+hLhjhLKPkeiHFgAEc+S9xRZ1drc6 E62A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ysZtnS5xnth5w0LemSDO+wCvjLXEmog+vjYaOIZiWJQ=; b=5lzNPFeOJipZ0Zk/ZzzpuT2cI6Sh83mYhB2B94QELK9FjmXYQHRCufe/AZ1FJmf4cq YcJjTr6/mCAdjZwiEUanSvK6GdMV3L4g0+e8cgsRZZzO9S4w9XHvf1CF6YhKOTfpaTTo zJKiin6KxjA+XQ6WTKPf4w1H0pJ9Eh6F7fmORVHRPNJ28iLb0oZmrteBO/NBEZ+IbzYr 6nuGU0FW/3a//3cpdPitWDpcq8sCQT3cewLuOcLmauKtQhcCYrOTo1nHItFu7ydmN2vf NI1d9CT0I6uMIpnYCdpXTTgHail/D2ovdljqUUcPZpHqrMKsJETzc5xLyJdcGRT3SPPP c+UQ== X-Gm-Message-State: ANoB5plkNchvEs8J27dF86jjJ0+7chsz79jUQlebLNHfwmgLVPRMdxY+ eikuWemJ56tOyeAh8ULYFHkc0w== X-Received: by 2002:adf:f188:0:b0:242:4f1:a1d with SMTP id h8-20020adff188000000b0024204f10a1dmr18371152wro.509.1669883619621; Thu, 01 Dec 2022 00:33:39 -0800 (PST) Received: from brgl-uxlite.home ([2a01:cb1d:334:ac00:26bb:b860:c227:f05d]) by smtp.gmail.com with ESMTPSA id p15-20020a05600c358f00b003c6b874a0dfsm6132349wmq.14.2022.12.01.00.33.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Dec 2022 00:33:39 -0800 (PST) From: Bartosz Golaszewski To: Kent Gibson , Linus Walleij , Andy Shevchenko Cc: linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org, Bartosz Golaszewski Subject: [PATCH v5 1/2] gpiolib: cdev: fix NULL-pointer dereferences Date: Thu, 1 Dec 2022 09:33:34 +0100 Message-Id: <20221201083335.819190-2-brgl@bgdev.pl> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20221201083335.819190-1-brgl@bgdev.pl> References: <20221201083335.819190-1-brgl@bgdev.pl> MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751000470482529532?= X-GMAIL-MSGID: =?utf-8?q?1751000470482529532?= From: Bartosz Golaszewski There are several places where we can crash the kernel by requesting lines, unbinding the GPIO device, then calling any of the system calls relevant to the GPIO character device's annonymous file descriptors: ioctl(), read(), poll(). While I observed it with the GPIO simulator, it will also happen for any of the GPIO devices that can be hot-unplugged - for instance any HID GPIO expander (e.g. CP2112). This affects both v1 and v2 uAPI. This fixes it partially by checking if gdev->chip is not NULL but it doesn't entirely remedy the situation as we still have a race condition in which another thread can remove the device after the check. Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL") Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL") Fixes: 7b8e00d98168 ("gpiolib: cdev: support GPIO_V2_LINE_SET_VALUES_IOCTL") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Kent Gibson --- drivers/gpio/gpiolib-cdev.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c index 0cb6b468f364..911d91668903 100644 --- a/drivers/gpio/gpiolib-cdev.c +++ b/drivers/gpio/gpiolib-cdev.c @@ -201,6 +201,9 @@ static long linehandle_ioctl(struct file *file, unsigned int cmd, unsigned int i; int ret; + if (!lh->gdev->chip) + return -ENODEV; + switch (cmd) { case GPIOHANDLE_GET_LINE_VALUES_IOCTL: /* NOTE: It's okay to read values of output lines */ @@ -1384,6 +1387,9 @@ static long linereq_ioctl(struct file *file, unsigned int cmd, struct linereq *lr = file->private_data; void __user *ip = (void __user *)arg; + if (!lr->gdev->chip) + return -ENODEV; + switch (cmd) { case GPIO_V2_LINE_GET_VALUES_IOCTL: return linereq_get_values(lr, ip); @@ -1410,6 +1416,9 @@ static __poll_t linereq_poll(struct file *file, struct linereq *lr = file->private_data; __poll_t events = 0; + if (!lr->gdev->chip) + return 0; + poll_wait(file, &lr->wait, wait); if (!kfifo_is_empty_spinlocked_noirqsave(&lr->events, @@ -1429,6 +1438,9 @@ static ssize_t linereq_read(struct file *file, ssize_t bytes_read = 0; int ret; + if (!lr->gdev->chip) + return -ENODEV; + if (count < sizeof(le)) return -EINVAL; @@ -1716,6 +1728,9 @@ static __poll_t lineevent_poll(struct file *file, struct lineevent_state *le = file->private_data; __poll_t events = 0; + if (!le->gdev->chip) + return 0; + poll_wait(file, &le->wait, wait); if (!kfifo_is_empty_spinlocked_noirqsave(&le->events, &le->wait.lock)) @@ -1740,6 +1755,9 @@ static ssize_t lineevent_read(struct file *file, ssize_t ge_size; int ret; + if (!le->gdev->chip) + return -ENODEV; + /* * When compatible system call is being used the struct gpioevent_data, * in case of at least ia32, has different size due to the alignment @@ -1821,6 +1839,9 @@ static long lineevent_ioctl(struct file *file, unsigned int cmd, void __user *ip = (void __user *)arg; struct gpiohandle_data ghd; + if (!le->gdev->chip) + return -ENODEV; + /* * We can get the value for an event line but not set it, * because it is input by definition. @@ -2407,6 +2428,9 @@ static __poll_t lineinfo_watch_poll(struct file *file, struct gpio_chardev_data *cdev = file->private_data; __poll_t events = 0; + if (!cdev->gdev->chip) + return 0; + poll_wait(file, &cdev->wait, pollt); if (!kfifo_is_empty_spinlocked_noirqsave(&cdev->events, @@ -2425,6 +2449,9 @@ static ssize_t lineinfo_watch_read(struct file *file, char __user *buf, int ret; size_t event_size; + if (!cdev->gdev->chip) + return -ENODEV; + #ifndef CONFIG_GPIO_CDEV_V1 event_size = sizeof(struct gpio_v2_line_info_changed); if (count < event_size)