mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
35b6fc51c6
syzbot reports a use-after-free in comedi in the below link, which is
due to comedi gladly removing the allocated async area even though poll
requests are still active on the wait_queue_head inside of it. This can
cause a use-after-free when the poll entries are later triggered or
removed, as the memory for the wait_queue_head has been freed. We need
to check there are no tasks queued on any of the subdevices' wait queues
before allowing the device to be detached by the `COMEDI_DEVCONFIG`
ioctl.
Tasks will read-lock `dev->attach_lock` before adding themselves to the
subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl
handler by write-locking `dev->attach_lock` before checking that all of
the subdevices are safe to be deleted. This includes testing for any
sleepers on the subdevices' wait queues. It remains locked until the
device has been detached. This requires the `comedi_device_detach()`
function to be refactored slightly, moving the bulk of it into new
function `comedi_device_detach_locked()`.
Note that the refactor of `comedi_device_detach()` results in
`comedi_device_cancel_all()` now being called while `dev->attach_lock`
is write-locked, which wasn't the case previously, but that does not
matter.
Thanks to Jens Axboe for diagnosing the problem and co-developing this
patch.
Cc: stable <stable@kernel.org>
Fixes: 2f3fdcd7ce ("staging: comedi: add rw_semaphore to protect against device detachment")
Link: https://lore.kernel.org/all/687bd5fe.a70a0220.693ce.0091.GAE@google.com/
Reported-by: syzbot+01523a0ae5600aef5895@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=01523a0ae5600aef5895
Co-developed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Tested-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/r/20250722155316.27432-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
74 lines
2.2 KiB
C
74 lines
2.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _COMEDI_INTERNAL_H
|
|
#define _COMEDI_INTERNAL_H
|
|
|
|
#include <linux/compiler.h>
|
|
#include <linux/types.h>
|
|
|
|
/*
|
|
* various internal comedi stuff
|
|
*/
|
|
|
|
struct comedi_buf_map;
|
|
struct comedi_devconfig;
|
|
struct comedi_device;
|
|
struct comedi_insn;
|
|
struct comedi_rangeinfo;
|
|
struct comedi_subdevice;
|
|
struct device;
|
|
|
|
int do_rangeinfo_ioctl(struct comedi_device *dev,
|
|
struct comedi_rangeinfo *it);
|
|
struct comedi_device *comedi_alloc_board_minor(struct device *hardware_device);
|
|
void comedi_release_hardware_device(struct device *hardware_device);
|
|
int comedi_alloc_subdevice_minor(struct comedi_subdevice *s);
|
|
void comedi_free_subdevice_minor(struct comedi_subdevice *s);
|
|
|
|
int comedi_buf_alloc(struct comedi_device *dev, struct comedi_subdevice *s,
|
|
unsigned long new_size);
|
|
void comedi_buf_reset(struct comedi_subdevice *s);
|
|
bool comedi_buf_is_mmapped(struct comedi_subdevice *s);
|
|
void comedi_buf_map_get(struct comedi_buf_map *bm);
|
|
int comedi_buf_map_put(struct comedi_buf_map *bm);
|
|
int comedi_buf_map_access(struct comedi_buf_map *bm, unsigned long offset,
|
|
void *buf, int len, int write);
|
|
struct comedi_buf_map *
|
|
comedi_buf_map_from_subdev_get(struct comedi_subdevice *s);
|
|
unsigned int comedi_buf_write_n_available(struct comedi_subdevice *s);
|
|
unsigned int comedi_buf_write_n_allocated(struct comedi_subdevice *s);
|
|
void comedi_device_cancel_all(struct comedi_device *dev);
|
|
bool comedi_can_auto_free_spriv(struct comedi_subdevice *s);
|
|
|
|
extern unsigned int comedi_default_buf_size_kb;
|
|
extern unsigned int comedi_default_buf_maxsize_kb;
|
|
|
|
/* drivers.c */
|
|
|
|
extern struct comedi_driver *comedi_drivers;
|
|
extern struct mutex comedi_drivers_list_lock;
|
|
|
|
int insn_inval(struct comedi_device *dev, struct comedi_subdevice *s,
|
|
struct comedi_insn *insn, unsigned int *data);
|
|
|
|
void comedi_device_detach_locked(struct comedi_device *dev);
|
|
void comedi_device_detach(struct comedi_device *dev);
|
|
int comedi_device_attach(struct comedi_device *dev,
|
|
struct comedi_devconfig *it);
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
|
|
/* proc.c */
|
|
|
|
void comedi_proc_init(void);
|
|
void comedi_proc_cleanup(void);
|
|
#else
|
|
static inline void comedi_proc_init(void)
|
|
{
|
|
}
|
|
|
|
static inline void comedi_proc_cleanup(void)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
#endif /* _COMEDI_INTERNAL_H */
|