Currently if miscdevice driver is compiled as module it can cause use
after free when unloading. To reproduce problem with Rust sample driver
we can do:
tail -f /dev/rust-misc-device
# And same time as device is open
sudo rmmod rust_misc_device_module
This will crash system. Fix is to have .owner field filled with module
information. We pass this owner information through vtable.
Reported-by: Youseok Yang <[email protected]>
Closes: https://github.com/Rust-for-Linux/linux/issues/1182
Fixes: f893691e7426 ("rust: miscdevice: add base miscdevice abstraction")
Signed-off-by: Kari Argillander <[email protected]>
---
rust/kernel/miscdevice.rs | 5 +++++
samples/rust/rust_misc_device.rs | 1 +
2 files changed, 6 insertions(+)
diff --git a/rust/kernel/miscdevice.rs b/rust/kernel/miscdevice.rs
index ba64c8a858f0..d4b0c35c4b60 100644
--- a/rust/kernel/miscdevice.rs
+++ b/rust/kernel/miscdevice.rs
@@ -18,6 +18,7 @@
mm::virt::VmaNew,
prelude::*,
seq_file::SeqFile,
+ this_module::ThisModule,
types::{ForeignOwnable, Opaque},
};
use core::{marker::PhantomData, pin::Pin};
@@ -112,6 +113,9 @@ fn drop(self: Pin<&mut Self>) {
/// Trait implemented by the private data of an open misc device.
#[vtable]
pub trait MiscDevice: Sized {
+ /// Module ownership for this device, provided via `THIS_MODULE`.
+ type ThisModule: ThisModule;
+
/// What kind of pointer should `Self` be wrapped in.
type Ptr: ForeignOwnable + Send + Sync;
@@ -388,6 +392,7 @@ impl<T: MiscDevice> MiscdeviceVTable<T> {
}
const VTABLE: bindings::file_operations = bindings::file_operations {
+ owner: T::ThisModule::OWNER.as_ptr(),
open: Some(Self::open),
release: Some(Self::release),
mmap: if T::HAS_MMAP { Some(Self::mmap) } else { None },
diff --git a/samples/rust/rust_misc_device.rs b/samples/rust/rust_misc_device.rs
index 49dd5814e1ab..464e3026e6e3 100644
--- a/samples/rust/rust_misc_device.rs
+++ b/samples/rust/rust_misc_device.rs
@@ -155,6 +155,7 @@ struct RustMiscDevice {
#[vtable]
impl MiscDevice for RustMiscDevice {
+ type ThisModule = THIS_MODULE;
type Ptr = Pin<KBox<Self>>;
fn open(_file: &File, misc: &MiscDeviceRegistration<Self>) ->
Result<Pin<KBox<Self>>> {
--
2.43.0
