kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-01 18:21:29 +00:00
Code Issues Releases Packages Activity
linux/drivers/iio/common
History
Tzung-Bi Shih 3b02dbd1cd iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data() 
[ Upstream commit 7771c8c80d ]

cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
calls iio_push_to_buffers_with_timestamp() without making sure the
`indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
buffer mode right before cros_ec_sensors_push_data() accesses them.

An use-after-free on `indio_dev->active_scan_mask` was observed.  The
call trace:
[...]
 _find_next_bit
 cros_ec_sensors_push_data
 cros_ec_sensorhub_event
 blocking_notifier_call_chain
 cros_ec_irq_thread

It was caused by a race condition: one thread just freed
`active_scan_mask` at [1]; while another thread tried to access the
memory at [2].

Fix it by calling iio_device_claim_buffer_mode() to ensure the
`indio_dev` can't exit buffer mode during cros_ec_sensors_push_data().

[1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189
[2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198

Cc: stable@vger.kernel.org
Fixes: aa984f1ba4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20230829030622.1571852-1-tzungbi@kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-10-25 12:03:09 +02:00
..
cros_ec_sensors iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data() 2023-10-25 12:03:09 +02:00
hid-sensors iio: triggered-buffer: extend support to configure output buffers 2021-10-19 08:30:45 +01:00
ms_sensors iio:common:meas-spec: Move exports into IIO_MEAS_SPEC_SENSORS 2022-02-18 11:42:26 +00:00
scmi_sensors iio: common: scmi_sensors: use HZ macro from units.h 2022-08-28 16:57:56 +01:00
ssp_sensors iio: common: ssp: Fix alignment for DMA safety 2022-06-14 11:53:15 +01:00
st_sensors iio: st_sensors: move from strlcpy with unused retval to strscpy 2022-08-19 18:23:14 +01:00
Kconfig iio/scmi: Adding support for IIO SCMI Based Sensors 2021-03-13 16:43:04 +00:00
Makefile iio/scmi: Adding support for IIO SCMI Based Sensors 2021-03-13 16:43:04 +00:00