Re: [PATCH v2] iio: buffer: fix use-after-free for attached_buffers array
On Mon, 8 Mar 2021 09:29:39 +0200
Alexandru Ardelean wrote:
> On Sun, Mar 7, 2021 at 8:55 PM Alexandru Ardelean
> wrote:
> >
> > Thanks to Lars for finding this.
> > The free of the 'attached_buffers' array should be done as late as
> > possible. This change moves it to iio_buffers_put(), which looks like
> > the best place for it, since it takes place right before the IIO device
> > data is free'd.
> > The free of this array will be handled by calling iio_device_free().
> > The iio_buffers_put() function is renamed to iio_device_detach_buffers()
> > since the role of this function changes a bit.
> >
> > It looks like this issue was ocurring on the error path of
> > iio_buffers_alloc_sysfs_and_mask() and in
> > iio_buffers_free_sysfs_and_mask()
> >
> > Added a comment in the doc-header of iio_device_attach_buffer() to
> > mention how this will be free'd in case anyone is reading the code
> > and becoming confused about it.
> >
> > Fixes: 36f3118c414d ("iio: buffer: introduce support for attaching more IIO
> > buffers")
> > Reported-by: Lars-Peter Clausen
> > Signed-off-by: Alexandru Ardelean
Applied to the togreg branch of iio.git and pushed out as testing for
the autobuilders to poke at it.
Thanks,
Jonathan
> > ---
>
> Forgot the changelog.
>
> Changelog v1 -> v2:
> * rename iio_buffers_put() -> iio_device_detach_buffers()
>
> > drivers/iio/iio_core.h| 4 ++--
> > drivers/iio/industrialio-buffer.c | 9 +
> > drivers/iio/industrialio-core.c | 2 +-
> > 3 files changed, 8 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/iio/iio_core.h b/drivers/iio/iio_core.h
> > index 062fe16c6c49..8f4a9b264962 100644
> > --- a/drivers/iio/iio_core.h
> > +++ b/drivers/iio/iio_core.h
> > @@ -77,7 +77,7 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev
> > *indio_dev);
> >
> > void iio_disable_all_buffers(struct iio_dev *indio_dev);
> > void iio_buffer_wakeup_poll(struct iio_dev *indio_dev);
> > -void iio_buffers_put(struct iio_dev *indio_dev);
> > +void iio_device_detach_buffers(struct iio_dev *indio_dev);
> >
> > #else
> >
> > @@ -93,7 +93,7 @@ static inline void iio_buffers_free_sysfs_and_mask(struct
> > iio_dev *indio_dev) {}
> >
> > static inline void iio_disable_all_buffers(struct iio_dev *indio_dev) {}
> > static inline void iio_buffer_wakeup_poll(struct iio_dev *indio_dev) {}
> > -static inline void iio_buffers_put(struct iio_dev *indio_dev) {}
> > +static inline void iio_device_detach_buffers(struct iio_dev *indio_dev) {}
> >
> > #endif
> >
> > diff --git a/drivers/iio/industrialio-buffer.c
> > b/drivers/iio/industrialio-buffer.c
> > index 1a415e97174e..1ff7f731b044 100644
> > --- a/drivers/iio/industrialio-buffer.c
> > +++ b/drivers/iio/industrialio-buffer.c
> > @@ -326,7 +326,7 @@ void iio_buffer_init(struct iio_buffer *buffer)
> > }
> > EXPORT_SYMBOL(iio_buffer_init);
> >
> > -void iio_buffers_put(struct iio_dev *indio_dev)
> > +void iio_device_detach_buffers(struct iio_dev *indio_dev)
> > {
> > struct iio_dev_opaque *iio_dev_opaque =
> > to_iio_dev_opaque(indio_dev);
> > struct iio_buffer *buffer;
> > @@ -336,6 +336,8 @@ void iio_buffers_put(struct iio_dev *indio_dev)
> > buffer = iio_dev_opaque->attached_buffers[i];
> > iio_buffer_put(buffer);
> > }
> > +
> > + kfree(iio_dev_opaque->attached_buffers);
> > }
> >
> > static ssize_t iio_show_scan_index(struct device *dev,
> > @@ -1764,7 +1766,6 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev
> > *indio_dev)
> > buffer = iio_dev_opaque->attached_buffers[unwind_idx];
> > __iio_buffer_free_sysfs_and_mask(buffer);
> > }
> > - kfree(iio_dev_opaque->attached_buffers);
> > return ret;
> > }
> >
> > @@ -1786,8 +1787,6 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev
> > *indio_dev)
> > buffer = iio_dev_opaque->attached_buffers[i];
> > __iio_buffer_free_sysfs_and_mask(buffer);
> > }
> > -
> > - kfree(iio_dev_opaque->attached_buffers);
> > }
> >
> > /**
> > @@ -2062,6 +2061,8 @@ static int iio_buffer_mmap(struct file *filep, struct
> > vm_area_struct *vma)
> > * This function attaches a buffer to a IIO device. The buffer stays
> > attached to
> > * the device until the device is freed. For legacy reasons, the first
> > attached
> > * buffer will also be assigned to 'indio_dev->buffer'.
> > + * The array allocated here, will be free'd via the
> > iio_device_detach_buffers()
> > + * call which is handled by the iio_device_free().
> > */
> > int iio_device_attach_buffer(struct iio_dev *indio_dev,
> > struct iio_buffer *buffer)
> > diff --git a/drivers/iio/industrialio-core.c
> > b/drivers/iio/industrialio-core.c
> > index d74fbac908df..3be5f75c2846 100644
> > --- a/drivers/iio/industrialio-core.c
> > +++ b/drivers/iio/industrialio-core.c
> > @@ -1587,7 +1587,7 @@ static void iio_dev_release(st
Re: [PATCH v2] iio: buffer: fix use-after-free for attached_buffers array
On Sun, Mar 7, 2021 at 8:55 PM Alexandru Ardelean
wrote:
>
> Thanks to Lars for finding this.
> The free of the 'attached_buffers' array should be done as late as
> possible. This change moves it to iio_buffers_put(), which looks like
> the best place for it, since it takes place right before the IIO device
> data is free'd.
> The free of this array will be handled by calling iio_device_free().
> The iio_buffers_put() function is renamed to iio_device_detach_buffers()
> since the role of this function changes a bit.
>
> It looks like this issue was ocurring on the error path of
> iio_buffers_alloc_sysfs_and_mask() and in
> iio_buffers_free_sysfs_and_mask()
>
> Added a comment in the doc-header of iio_device_attach_buffer() to
> mention how this will be free'd in case anyone is reading the code
> and becoming confused about it.
>
> Fixes: 36f3118c414d ("iio: buffer: introduce support for attaching more IIO
> buffers")
> Reported-by: Lars-Peter Clausen
> Signed-off-by: Alexandru Ardelean
> ---
Forgot the changelog.
Changelog v1 -> v2:
* rename iio_buffers_put() -> iio_device_detach_buffers()
> drivers/iio/iio_core.h| 4 ++--
> drivers/iio/industrialio-buffer.c | 9 +
> drivers/iio/industrialio-core.c | 2 +-
> 3 files changed, 8 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/iio/iio_core.h b/drivers/iio/iio_core.h
> index 062fe16c6c49..8f4a9b264962 100644
> --- a/drivers/iio/iio_core.h
> +++ b/drivers/iio/iio_core.h
> @@ -77,7 +77,7 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev
> *indio_dev);
>
> void iio_disable_all_buffers(struct iio_dev *indio_dev);
> void iio_buffer_wakeup_poll(struct iio_dev *indio_dev);
> -void iio_buffers_put(struct iio_dev *indio_dev);
> +void iio_device_detach_buffers(struct iio_dev *indio_dev);
>
> #else
>
> @@ -93,7 +93,7 @@ static inline void iio_buffers_free_sysfs_and_mask(struct
> iio_dev *indio_dev) {}
>
> static inline void iio_disable_all_buffers(struct iio_dev *indio_dev) {}
> static inline void iio_buffer_wakeup_poll(struct iio_dev *indio_dev) {}
> -static inline void iio_buffers_put(struct iio_dev *indio_dev) {}
> +static inline void iio_device_detach_buffers(struct iio_dev *indio_dev) {}
>
> #endif
>
> diff --git a/drivers/iio/industrialio-buffer.c
> b/drivers/iio/industrialio-buffer.c
> index 1a415e97174e..1ff7f731b044 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -326,7 +326,7 @@ void iio_buffer_init(struct iio_buffer *buffer)
> }
> EXPORT_SYMBOL(iio_buffer_init);
>
> -void iio_buffers_put(struct iio_dev *indio_dev)
> +void iio_device_detach_buffers(struct iio_dev *indio_dev)
> {
> struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev);
> struct iio_buffer *buffer;
> @@ -336,6 +336,8 @@ void iio_buffers_put(struct iio_dev *indio_dev)
> buffer = iio_dev_opaque->attached_buffers[i];
> iio_buffer_put(buffer);
> }
> +
> + kfree(iio_dev_opaque->attached_buffers);
> }
>
> static ssize_t iio_show_scan_index(struct device *dev,
> @@ -1764,7 +1766,6 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev
> *indio_dev)
> buffer = iio_dev_opaque->attached_buffers[unwind_idx];
> __iio_buffer_free_sysfs_and_mask(buffer);
> }
> - kfree(iio_dev_opaque->attached_buffers);
> return ret;
> }
>
> @@ -1786,8 +1787,6 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev
> *indio_dev)
> buffer = iio_dev_opaque->attached_buffers[i];
> __iio_buffer_free_sysfs_and_mask(buffer);
> }
> -
> - kfree(iio_dev_opaque->attached_buffers);
> }
>
> /**
> @@ -2062,6 +2061,8 @@ static int iio_buffer_mmap(struct file *filep, struct
> vm_area_struct *vma)
> * This function attaches a buffer to a IIO device. The buffer stays
> attached to
> * the device until the device is freed. For legacy reasons, the first
> attached
> * buffer will also be assigned to 'indio_dev->buffer'.
> + * The array allocated here, will be free'd via the
> iio_device_detach_buffers()
> + * call which is handled by the iio_device_free().
> */
> int iio_device_attach_buffer(struct iio_dev *indio_dev,
> struct iio_buffer *buffer)
> diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
> index d74fbac908df..3be5f75c2846 100644
> --- a/drivers/iio/industrialio-core.c
> +++ b/drivers/iio/industrialio-core.c
> @@ -1587,7 +1587,7 @@ static void iio_dev_release(struct device *device)
> iio_device_unregister_eventset(indio_dev);
> iio_device_unregister_sysfs(indio_dev);
>
> - iio_buffers_put(indio_dev);
> + iio_device_detach_buffers(indio_dev);
>
> ida_simple_remove(&iio_ida, indio_dev->id);
> kfree(iio_dev_opaque);
> --
> 2.25.1
>
