lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

efi: capsule-loader: Fix use-after-free in efi_capsule_write

Browse Source 
commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 upstream.

A race condition may occur if the user calls close() on another thread
during a write() operation on the device node of the efi capsule.

This is a race condition that occurs between the efi_capsule_write() and
efi_capsule_flush() functions of efi_capsule_fops, which ultimately
results in UAF.

So, the page freeing process is modified to be done in
efi_capsule_release() instead of efi_capsule_flush().

Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Hyunwoo Kim 2022-09-07 09:07:14 -07:00 committed by Greg Kroah-Hartman
parent d6deb370b5
commit 8028ff4cdb
1 changed files with 7 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
drivers/firmware/efi/capsule-loader.c
View File

@ -241,29 +241,6 @@ failed:
return ret; return ret;
} }
/**
* efi_capsule_flush - called by file close or file flush
* @file: file pointer
* @id: not used
*
* If a capsule is being partially uploaded then calling this function
* will be treated as upload termination and will free those completed
* buffer pages and -ECANCELED will be returned.
**/
static int efi_capsule_flush(struct file *file, fl_owner_t id)
{
int ret = 0;
struct capsule_info *cap_info = file->private_data;
if (cap_info->index > 0) {
pr_err("capsule upload not complete\n");
efi_free_all_buff_pages(cap_info);
ret = -ECANCELED;
}
return ret;
}
/** /**
* efi_capsule_release - called by file close * efi_capsule_release - called by file close
* @inode: not used * @inode: not used
@ -276,6 +253,13 @@ static int efi_capsule_release(struct inode *inode, struct file *file)
{ {
struct capsule_info *cap_info = file->private_data; struct capsule_info *cap_info = file->private_data;
if (cap_info->index > 0 &&
(cap_info->header.headersize == 0 ||
cap_info->count < cap_info->total_size)) {
pr_err("capsule upload not complete\n");
efi_free_all_buff_pages(cap_info);
}
kfree(cap_info->pages); kfree(cap_info->pages);
kfree(cap_info->phys); kfree(cap_info->phys);
kfree(file->private_data); kfree(file->private_data);
@ -323,7 +307,6 @@ static const struct file_operations efi_capsule_fops = {
.owner = THIS_MODULE, .owner = THIS_MODULE,
.open = efi_capsule_open, .open = efi_capsule_open,
.write = efi_capsule_write, .write = efi_capsule_write,
.flush = efi_capsule_flush,
.release = efi_capsule_release, .release = efi_capsule_release,
.llseek = no_llseek, .llseek = no_llseek,
}; };