lkml.org 
[lkml]   [2021]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 18/40] nfc: nfcsim: fix use after free during module unload
    Date
    From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>

    commit 5e7b30d24a5b8cb691c173b45b50e3ca0191be19 upstream.

    There is a use after free memory corruption during module exit:
    - nfcsim_exit()
    - nfcsim_device_free(dev0)
    - nfc_digital_unregister_device()
    This iterates over command queue and frees all commands,
    - dev->up = false
    - nfcsim_link_shutdown()
    - nfcsim_link_recv_wake()
    This wakes the sleeping thread nfcsim_link_recv_skb().

    - nfcsim_link_recv_skb()
    Wake from wait_event_interruptible_timeout(),
    call directly the deb->cb callback even though (dev->up == false),
    - digital_send_cmd_complete()
    Dereference of "struct digital_cmd" cmd which was freed earlier by
    nfc_digital_unregister_device().

    This causes memory corruption shortly after (with unrelated stack
    trace):

    nfc nfc0: NFC: nfcsim_recv_wq: Device is down
    llcp: nfc_llcp_recv: err -19
    nfc nfc1: NFC: nfcsim_recv_wq: Device is down
    BUG: unable to handle page fault for address: ffffffffffffffed
    Call Trace:
    fsnotify+0x54b/0x5c0
    __fsnotify_parent+0x1fe/0x300
    ? vfs_write+0x27c/0x390
    vfs_write+0x27c/0x390
    ksys_write+0x63/0xe0
    do_syscall_64+0x3b/0x90
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    KASAN report:

    BUG: KASAN: use-after-free in digital_send_cmd_complete+0x16/0x50
    Write of size 8 at addr ffff88800a05f720 by task kworker/0:2/71
    Workqueue: events nfcsim_recv_wq [nfcsim]
    Call Trace:
     dump_stack_lvl+0x45/0x59
     print_address_description.constprop.0+0x21/0x140
     ? digital_send_cmd_complete+0x16/0x50
     ? digital_send_cmd_complete+0x16/0x50
     kasan_report.cold+0x7f/0x11b
     ? digital_send_cmd_complete+0x16/0x50
     ? digital_dep_link_down+0x60/0x60
     digital_send_cmd_complete+0x16/0x50
     nfcsim_recv_wq+0x38f/0x3d5 [nfcsim]
     ? nfcsim_in_send_cmd+0x4a/0x4a [nfcsim]
     ? lock_is_held_type+0x98/0x110
     ? finish_wait+0x110/0x110
     ? rcu_read_lock_sched_held+0x9c/0xd0
     ? rcu_read_lock_bh_held+0xb0/0xb0
     ? lockdep_hardirqs_on_prepare+0x12e/0x1f0

    This flow of calling digital_send_cmd_complete() callback on driver exit
    is specific to nfcsim which implements reading and sending work queues.
    Since the NFC digital device was unregistered, the callback should not
    be called.

    Fixes: 204bddcb508f ("NFC: nfcsim: Make use of the Digital layer")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/nfc/nfcsim.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/nfc/nfcsim.c
    +++ b/drivers/nfc/nfcsim.c
    @@ -192,8 +192,7 @@ static void nfcsim_recv_wq(struct work_s

    if (!IS_ERR(skb))
    dev_kfree_skb(skb);
    -
    - skb = ERR_PTR(-ENODEV);
    + return;
    }

    dev->cb(dev->nfc_digital_dev, dev->arg, skb);

    \
     
     \ /
      Last update: 2021-08-02 15:58    [W:4.123 / U:1.564 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site