From nobody Fri Dec 19 07:47:22 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9C1CC6FA89 for ; Tue, 13 Sep 2022 14:09:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232628AbiIMOJK (ORCPT ); Tue, 13 Sep 2022 10:09:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50430 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232645AbiIMOId (ORCPT ); Tue, 13 Sep 2022 10:08:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 18DA41D339; Tue, 13 Sep 2022 07:08:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4B6E5614A3; Tue, 13 Sep 2022 14:08:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49727C433D7; Tue, 13 Sep 2022 14:08:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078098; bh=U0lw36v5K3lnpJ4xVPpX9D5MtIMf5s6/6zDt1oauxo8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BAIWSRhSRLRlaem+RSt46Vf5xJCDpjweEuAefYHVtXml8Xhzc1EV1UzlazXOk5EAX m1DAWCxexnPhIDVVpfEHivyIRH/+cyyjZVvnSJ8fJ/VKEh9ebE8lUD7Y7bYJExWBEz DWkjB/tBB+97Uy25KD33/HCXw1GVbMv/JUBQetd0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hyunwoo Kim , Ard Biesheuvel Subject: [PATCH 5.19 002/192] efi: capsule-loader: Fix use-after-free in efi_capsule_write Date: Tue, 13 Sep 2022 16:01:48 +0200 Message-Id: <20220913140410.150061649@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140410.043243217@linuxfoundation.org> References: <20220913140410.043243217@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hyunwoo Kim commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 upstream. A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: # v4.9+ Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/efi/capsule-loader.c | 31 +++++++----------------------= -- 1 file changed, 7 insertions(+), 24 deletions(-) --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -243,29 +243,6 @@ failed: } =20 /** - * efi_capsule_flush - called by file close or file flush - * @file: file pointer - * @id: not used - * - * If a capsule is being partially uploaded then calling this function - * will be treated as upload termination and will free those completed - * buffer pages and -ECANCELED will be returned. - **/ -static int efi_capsule_flush(struct file *file, fl_owner_t id) -{ - int ret =3D 0; - struct capsule_info *cap_info =3D file->private_data; - - if (cap_info->index > 0) { - pr_err("capsule upload not complete\n"); - efi_free_all_buff_pages(cap_info); - ret =3D -ECANCELED; - } - - return ret; -} - -/** * efi_capsule_release - called by file close * @inode: not used * @file: file pointer @@ -277,6 +254,13 @@ static int efi_capsule_release(struct in { struct capsule_info *cap_info =3D file->private_data; =20 + if (cap_info->index > 0 && + (cap_info->header.headersize =3D=3D 0 || + cap_info->count < cap_info->total_size)) { + pr_err("capsule upload not complete\n"); + efi_free_all_buff_pages(cap_info); + } + kfree(cap_info->pages); kfree(cap_info->phys); kfree(file->private_data); @@ -324,7 +308,6 @@ static const struct file_operations efi_ .owner =3D THIS_MODULE, .open =3D efi_capsule_open, .write =3D efi_capsule_write, - .flush =3D efi_capsule_flush, .release =3D efi_capsule_release, .llseek =3D no_llseek, };