1. Patchew
  2. linux
  3. View series

[PATCH v3] cdx: Fix possible UAF error in driver_override_show()

Qiu-ji Chen posted 1 patch 11 months ago
There is a newer version of this series
drivers/cdx/cdx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
[PATCH v3] cdx: Fix possible UAF error in driver_override_show()
Posted by Qiu-ji Chen 11 months ago 
Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which
includes both driver_override_show() and driver_override_store().
These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to
update the driver_override value, and driver_set_override() internally
locks the device (device_lock(dev)). If driver_override_show() reads
cdx_dev->driver_override without locking, it could potentially access
a freed pointer if driver_override_store() frees the string
concurrently. This could lead to printing a kernel address, which is a
security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well
as many other bus drivers, where device_lock() is taken in the show
function, and it has been working without issues.

This possible bug is found by an experimental static analysis tool
developed by our team. This tool analyzes the locking APIs to extract
function pairs that can be concurrently executed, and then analyzes the
instructions in the paired functions to identify possible concurrency bugs
including data races and atomicity violations.

Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
Cc: stable@vger.kernel.org
Signed-off-by: Qiu-ji Chen <chenqiuji666@gmail.com>
---
V2:
Modified the title and description.
Removed the changes to cdx_bus_match().

V3:
Revised the description to reduce the confusion it caused.
---
 drivers/cdx/cdx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c
index 07371cb653d3..e696ba0b573e 100644
--- a/drivers/cdx/cdx.c
+++ b/drivers/cdx/cdx.c
@@ -470,8 +470,11 @@ static ssize_t driver_override_show(struct device *dev,
 				    struct device_attribute *attr, char *buf)
 {
 	struct cdx_device *cdx_dev = to_cdx_device(dev);
+	ssize_t len;
 
-	return sysfs_emit(buf, "%s\n", cdx_dev->driver_override);
+	device_lock(dev);
+	len = sysfs_emit(buf, "%s\n", cdx_dev->driver_override);
+	device_unlock(dev);
 }
 static DEVICE_ATTR_RW(driver_override);
 
-- 
2.34.1
Re: [PATCH v3] cdx: Fix possible UAF error in driver_override_show()
Posted by kernel test robot 11 months ago 
Hi Qiu-ji,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linus/master]
[also build test WARNING on v6.13-rc7 next-20250117]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Qiu-ji-Chen/cdx-Fix-possible-UAF-error-in-driver_override_show/20250115-170808
base:   linus/master
patch link:    https://lore.kernel.org/r/20250115090449.102060-1-chenqiuji666%40gmail.com
patch subject: [PATCH v3] cdx: Fix possible UAF error in driver_override_show()
config: arm64-randconfig-002-20250116 (https://download.01.org/0day-ci/archive/20250118/202501180932.8MILoqSq-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180932.8MILoqSq-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202501180932.8MILoqSq-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/cdx/cdx.c: In function 'driver_override_show':
>> drivers/cdx/cdx.c:473:17: warning: variable 'len' set but not used [-Wunused-but-set-variable]
     473 |         ssize_t len;
         |                 ^~~
>> drivers/cdx/cdx.c:478:1: warning: no return statement in function returning non-void [-Wreturn-type]
     478 | }
         | ^


vim +/len +473 drivers/cdx/cdx.c

   468	
   469	static ssize_t driver_override_show(struct device *dev,
   470					    struct device_attribute *attr, char *buf)
   471	{
   472		struct cdx_device *cdx_dev = to_cdx_device(dev);
 > 473		ssize_t len;
   474	
   475		device_lock(dev);
   476		len = sysfs_emit(buf, "%s\n", cdx_dev->driver_override);
   477		device_unlock(dev);
 > 478	}
   479	static DEVICE_ATTR_RW(driver_override);
   480	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Re: [PATCH v3] cdx: Fix possible UAF error in driver_override_show()
Posted by kernel test robot 11 months ago 
Hi Qiu-ji,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linus/master]
[also build test WARNING on v6.13-rc7 next-20250117]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Qiu-ji-Chen/cdx-Fix-possible-UAF-error-in-driver_override_show/20250115-170808
base:   linus/master
patch link:    https://lore.kernel.org/r/20250115090449.102060-1-chenqiuji666%40gmail.com
patch subject: [PATCH v3] cdx: Fix possible UAF error in driver_override_show()
config: arm64-randconfig-004-20250116 (https://download.01.org/0day-ci/archive/20250118/202501180719.sDmtGnhD-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project f5cd181ffbb7cb61d582fe130d46580d5969d47a)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180719.sDmtGnhD-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202501180719.sDmtGnhD-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/cdx/cdx.c:473:10: warning: variable 'len' set but not used [-Wunused-but-set-variable]
     473 |         ssize_t len;
         |                 ^
>> drivers/cdx/cdx.c:478:1: warning: non-void function does not return a value [-Wreturn-type]
     478 | }
         | ^
   2 warnings generated.


vim +478 drivers/cdx/cdx.c

48a6c7bced2a78 Nipun Gupta 2023-03-13  468  
48a6c7bced2a78 Nipun Gupta 2023-03-13  469  static ssize_t driver_override_show(struct device *dev,
48a6c7bced2a78 Nipun Gupta 2023-03-13  470  				    struct device_attribute *attr, char *buf)
48a6c7bced2a78 Nipun Gupta 2023-03-13  471  {
48a6c7bced2a78 Nipun Gupta 2023-03-13  472  	struct cdx_device *cdx_dev = to_cdx_device(dev);
4228bb0224f83f Qiu-ji Chen 2025-01-15  473  	ssize_t len;
48a6c7bced2a78 Nipun Gupta 2023-03-13  474  
4228bb0224f83f Qiu-ji Chen 2025-01-15  475  	device_lock(dev);
4228bb0224f83f Qiu-ji Chen 2025-01-15  476  	len = sysfs_emit(buf, "%s\n", cdx_dev->driver_override);
4228bb0224f83f Qiu-ji Chen 2025-01-15  477  	device_unlock(dev);
48a6c7bced2a78 Nipun Gupta 2023-03-13 @478  }
48a6c7bced2a78 Nipun Gupta 2023-03-13  479  static DEVICE_ATTR_RW(driver_override);
48a6c7bced2a78 Nipun Gupta 2023-03-13  480  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.