Re: [PATCH v2] iio: buffer: fix use-after-free for attached_buffers array

[Jonathan Cameron]

On Mon, 8 Mar 2021 09:29:39 +0200
Alexandru Ardelean <ardeleanalex@xxxxxxxxx> wrote:

> On Sun, Mar 7, 2021 at 8:55 PM Alexandru Ardelean
> <ardeleanalex@xxxxxxxxx> wrote:
> >
> > Thanks to Lars for finding this.
> > The free of the 'attached_buffers' array should be done as late as
> > possible. This change moves it to iio_buffers_put(), which looks like
> > the best place for it, since it takes place right before the IIO device
> > data is free'd.
> > The free of this array will be handled by calling iio_device_free().
> > The iio_buffers_put() function is renamed to iio_device_detach_buffers()
> > since the role of this function changes a bit.
> >
> > It looks like this issue was ocurring on the error path of
> > iio_buffers_alloc_sysfs_and_mask() and in
> > iio_buffers_free_sysfs_and_mask()
> >
> > Added a comment in the doc-header of iio_device_attach_buffer() to
> > mention how this will be free'd in case anyone is reading the code
> > and becoming confused about it.
> >
> > Fixes: 36f3118c414d ("iio: buffer: introduce support for attaching more IIO buffers")
> > Reported-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> > Signed-off-by: Alexandru Ardelean <ardeleanalex@xxxxxxxxx>
Applied to the togreg branch of iio.git and pushed out as testing for
the autobuilders to poke at it.

Thanks,

Jonathan
> > ---  
> 
> Forgot the changelog.
> 
> Changelog v1 -> v2:
> * rename iio_buffers_put() -> iio_device_detach_buffers()
> 
> >  drivers/iio/iio_core.h            | 4 ++--
> >  drivers/iio/industrialio-buffer.c | 9 +++++----
> >  drivers/iio/industrialio-core.c   | 2 +-
> >  3 files changed, 8 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/iio/iio_core.h b/drivers/iio/iio_core.h
> > index 062fe16c6c49..8f4a9b264962 100644
> > --- a/drivers/iio/iio_core.h
> > +++ b/drivers/iio/iio_core.h
> > @@ -77,7 +77,7 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev);
> >
> >  void iio_disable_all_buffers(struct iio_dev *indio_dev);
> >  void iio_buffer_wakeup_poll(struct iio_dev *indio_dev);
> > -void iio_buffers_put(struct iio_dev *indio_dev);
> > +void iio_device_detach_buffers(struct iio_dev *indio_dev);
> >
> >  #else
> >
> > @@ -93,7 +93,7 @@ static inline void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev) {}
> >
> >  static inline void iio_disable_all_buffers(struct iio_dev *indio_dev) {}
> >  static inline void iio_buffer_wakeup_poll(struct iio_dev *indio_dev) {}
> > -static inline void iio_buffers_put(struct iio_dev *indio_dev) {}
> > +static inline void iio_device_detach_buffers(struct iio_dev *indio_dev) {}
> >
> >  #endif
> >
> > diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> > index 1a415e97174e..1ff7f731b044 100644
> > --- a/drivers/iio/industrialio-buffer.c
> > +++ b/drivers/iio/industrialio-buffer.c
> > @@ -326,7 +326,7 @@ void iio_buffer_init(struct iio_buffer *buffer)
> >  }
> >  EXPORT_SYMBOL(iio_buffer_init);
> >
> > -void iio_buffers_put(struct iio_dev *indio_dev)
> > +void iio_device_detach_buffers(struct iio_dev *indio_dev)
> >  {
> >         struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev);
> >         struct iio_buffer *buffer;
> > @@ -336,6 +336,8 @@ void iio_buffers_put(struct iio_dev *indio_dev)
> >                 buffer = iio_dev_opaque->attached_buffers[i];
> >                 iio_buffer_put(buffer);
> >         }
> > +
> > +       kfree(iio_dev_opaque->attached_buffers);
> >  }
> >
> >  static ssize_t iio_show_scan_index(struct device *dev,
> > @@ -1764,7 +1766,6 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev *indio_dev)
> >                 buffer = iio_dev_opaque->attached_buffers[unwind_idx];
> >                 __iio_buffer_free_sysfs_and_mask(buffer);
> >         }
> > -       kfree(iio_dev_opaque->attached_buffers);
> >         return ret;
> >  }
> >
> > @@ -1786,8 +1787,6 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev)
> >                 buffer = iio_dev_opaque->attached_buffers[i];
> >                 __iio_buffer_free_sysfs_and_mask(buffer);
> >         }
> > -
> > -       kfree(iio_dev_opaque->attached_buffers);
> >  }
> >
> >  /**
> > @@ -2062,6 +2061,8 @@ static int iio_buffer_mmap(struct file *filep, struct vm_area_struct *vma)
> >   * This function attaches a buffer to a IIO device. The buffer stays attached to
> >   * the device until the device is freed. For legacy reasons, the first attached
> >   * buffer will also be assigned to 'indio_dev->buffer'.
> > + * The array allocated here, will be free'd via the iio_device_detach_buffers()
> > + * call which is handled by the iio_device_free().
> >   */
> >  int iio_device_attach_buffer(struct iio_dev *indio_dev,
> >                              struct iio_buffer *buffer)
> > diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
> > index d74fbac908df..3be5f75c2846 100644
> > --- a/drivers/iio/industrialio-core.c
> > +++ b/drivers/iio/industrialio-core.c
> > @@ -1587,7 +1587,7 @@ static void iio_dev_release(struct device *device)
> >         iio_device_unregister_eventset(indio_dev);
> >         iio_device_unregister_sysfs(indio_dev);
> >
> > -       iio_buffers_put(indio_dev);
> > +       iio_device_detach_buffers(indio_dev);
> >
> >         ida_simple_remove(&iio_ida, indio_dev->id);
> >         kfree(iio_dev_opaque);
> > --
> > 2.25.1
> >