tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

platform/x86: p2sb: Fix UAF when caller uses resource name

We have to copy only selected fields from the original resource.
Because a PCI device will be removed immediately after getting
its resources, we may not use any allocated data, hence we may
not copy any pointers.

Consider the following scenario:

1/ a caller of p2sb_bar() gets the resource;

2/ the resource has been copied by platform_device_add_data()
in order to create a platform device;

3/ the platform device creation will call for the device driver's
->probe() as soon as a match found;

4/ the ->probe() takes given resources (see 2/) and tries to
access one of its field, i.e. 'name', in the
__devm_ioremap_resource() to create a pretty looking output;

5/ but the 'name' is a dangling pointer because p2sb_bar()
removed a PCI device, which 'name' had been copied to
the caller's memory.

6/ UAF (Use-After-Free) as a result.

Kudos to Mika for the initial analisys of the issue.

Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support")
Reported-by: kernel test robot <oliver.sang@intel.com>
Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/
Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>

authored by

Andy Shevchenko and committed by
Hans de Goede f98d67ac 134038b0

+16 -2
+16 -2
drivers/platform/x86/p2sb.c
··· 42 42 return 0; 43 43 } 44 44 45 + /* Copy resource from the first BAR of the device in question */ 45 46 static int p2sb_read_bar0(struct pci_dev *pdev, struct resource *mem) 46 47 { 47 - /* Copy resource from the first BAR of the device in question */ 48 - *mem = pdev->resource[0]; 48 + struct resource *bar0 = &pdev->resource[0]; 49 + 50 + /* Make sure we have no dangling pointers in the output */ 51 + memset(mem, 0, sizeof(*mem)); 52 + 53 + /* 54 + * We copy only selected fields from the original resource. 55 + * Because a PCI device will be removed soon, we may not use 56 + * any allocated data, hence we may not copy any pointers. 57 + */ 58 + mem->start = bar0->start; 59 + mem->end = bar0->end; 60 + mem->flags = bar0->flags; 61 + mem->desc = bar0->desc; 62 + 49 63 return 0; 50 64 } 51 65