lkml.org 
[lkml]   [2012]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[03/42] firmware: Fix an oops on reading fw_priv->fw in sysfs loading file
    3.1-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Neil Horman <nhorman@tuxdriver.com>

    commit eea915bb0d1358755f151eaefb8208a2d5f3e10c upstream.

    This oops was reported recently:
    firmware_loading_store+0xf9/0x17b
    dev_attr_store+0x20/0x22
    sysfs_write_file+0x101/0x134
    vfs_write+0xac/0xf3
    sys_write+0x4a/0x6e
    system_call_fastpath+0x16/0x1b

    The complete backtrace was unfortunately not captured, but details can be found
    here:
    https://bugzilla.redhat.com/show_bug.cgi?id=769920

    The cause is fairly clear.

    Its caused by the fact that firmware_loading_store has a case 0 in its
    switch statement that reads and writes the fw_priv->fw poniter without the
    protection of the fw_lock mutex. since there is a window between the time that
    _request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs
    file is unregistered, its possible for a user space application to race in, and
    write a zero to the loading file, causing a NULL dereference in
    firmware_loading_store. Fix it by extending the protection of the fw_lock mutex
    to cover all of the firware_loading_store function.

    Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/base/firmware_class.c | 14 +++++++-------
    1 file changed, 7 insertions(+), 7 deletions(-)

    --- a/drivers/base/firmware_class.c
    +++ b/drivers/base/firmware_class.c
    @@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(st
    int loading = simple_strtol(buf, NULL, 10);
    int i;

    + mutex_lock(&fw_lock);
    +
    + if (!fw_priv->fw)
    + goto out;
    +
    switch (loading) {
    case 1:
    - mutex_lock(&fw_lock);
    - if (!fw_priv->fw) {
    - mutex_unlock(&fw_lock);
    - break;
    - }
    firmware_free_data(fw_priv->fw);
    memset(fw_priv->fw, 0, sizeof(struct firmware));
    /* If the pages are not owned by 'struct firmware' */
    @@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(st
    fw_priv->page_array_size = 0;
    fw_priv->nr_pages = 0;
    set_bit(FW_STATUS_LOADING, &fw_priv->status);
    - mutex_unlock(&fw_lock);
    break;
    case 0:
    if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
    @@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(st
    fw_load_abort(fw_priv);
    break;
    }
    -
    +out:
    + mutex_unlock(&fw_lock);
    return count;
    }




    \
     
     \ /
      Last update: 2012-01-11 00:23    [W:0.020 / U:211.888 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site