[SRU][Zesty][PATCH][CVE-2017-12146] driver core: platform: fix race condition with driver_override

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

[SRU][Zesty][PATCH][CVE-2017-12146] driver core: platform: fix race condition with driver_override

Kleber Souza
From: Adrian Salido <[hidden email]>

CVE-2017-12146

The driver_override implementation is susceptible to race condition when
different threads are reading vs storing a different driver override.
Add locking to avoid race condition.

Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'")
Cc: [hidden email]
Signed-off-by: Adrian Salido <[hidden email]>
Signed-off-by: Greg Kroah-Hartman <[hidden email]>
(cherry picked from commit 6265539776a0810b7ce6398c27866ddb9c6bd154)
Signed-off-by: Kleber Sacilotto de Souza <[hidden email]>
---
 drivers/base/platform.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 647e4761dbf3..4ce2f9daa62a 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -866,7 +866,7 @@ static ssize_t driver_override_store(struct device *dev,
      const char *buf, size_t count)
 {
  struct platform_device *pdev = to_platform_device(dev);
- char *driver_override, *old = pdev->driver_override, *cp;
+ char *driver_override, *old, *cp;
 
  if (count > PATH_MAX)
  return -EINVAL;
@@ -879,12 +879,15 @@ static ssize_t driver_override_store(struct device *dev,
  if (cp)
  *cp = '\0';
 
+ device_lock(dev);
+ old = pdev->driver_override;
  if (strlen(driver_override)) {
  pdev->driver_override = driver_override;
  } else {
  kfree(driver_override);
  pdev->driver_override = NULL;
  }
+ device_unlock(dev);
 
  kfree(old);
 
@@ -895,8 +898,12 @@ static ssize_t driver_override_show(struct device *dev,
     struct device_attribute *attr, char *buf)
 {
  struct platform_device *pdev = to_platform_device(dev);
+ ssize_t len;
 
- return sprintf(buf, "%s\n", pdev->driver_override);
+ device_lock(dev);
+ len = sprintf(buf, "%s\n", pdev->driver_override);
+ device_unlock(dev);
+ return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 
--
2.14.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [SRU][Zesty][PATCH][CVE-2017-12146] driver core: platform: fix race condition with driver_override

Stefan Bader-2
On 03.11.2017 09:01, Kleber Sacilotto de Souza wrote:

> From: Adrian Salido <[hidden email]>
>
> CVE-2017-12146
>
> The driver_override implementation is susceptible to race condition when
> different threads are reading vs storing a different driver override.
> Add locking to avoid race condition.
>
> Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'")
> Cc: [hidden email]
> Signed-off-by: Adrian Salido <[hidden email]>
> Signed-off-by: Greg Kroah-Hartman <[hidden email]>
> (cherry picked from commit 6265539776a0810b7ce6398c27866ddb9c6bd154)
> Signed-off-by: Kleber Sacilotto de Souza <[hidden email]>
Acked-by: Stefan Bader <[hidden email]>

> ---
>  drivers/base/platform.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index 647e4761dbf3..4ce2f9daa62a 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -866,7 +866,7 @@ static ssize_t driver_override_store(struct device *dev,
>       const char *buf, size_t count)
>  {
>   struct platform_device *pdev = to_platform_device(dev);
> - char *driver_override, *old = pdev->driver_override, *cp;
> + char *driver_override, *old, *cp;
>  
>   if (count > PATH_MAX)
>   return -EINVAL;
> @@ -879,12 +879,15 @@ static ssize_t driver_override_store(struct device *dev,
>   if (cp)
>   *cp = '\0';
>  
> + device_lock(dev);
> + old = pdev->driver_override;
>   if (strlen(driver_override)) {
>   pdev->driver_override = driver_override;
>   } else {
>   kfree(driver_override);
>   pdev->driver_override = NULL;
>   }
> + device_unlock(dev);
>  
>   kfree(old);
>  
> @@ -895,8 +898,12 @@ static ssize_t driver_override_show(struct device *dev,
>      struct device_attribute *attr, char *buf)
>  {
>   struct platform_device *pdev = to_platform_device(dev);
> + ssize_t len;
>  
> - return sprintf(buf, "%s\n", pdev->driver_override);
> + device_lock(dev);
> + len = sprintf(buf, "%s\n", pdev->driver_override);
> + device_unlock(dev);
> + return len;
>  }
>  static DEVICE_ATTR_RW(driver_override);
>  
>


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team

signature.asc (836 bytes) Download Attachment