[PATCH 1/2] most: configfs: serialize mdev_link_list with a mutex

[Yu Zhang]

mdev_link_list is a single global list, but it is accessed with no
serialization. mdev_link_create_link_store() adds to it,
mdev_link_destroy_link_store() and mdev_link_release() remove from it
(the latter then frees the entry), and most_interface_register_notify()
walks it.

These run under different locks, or none. The create/destroy stores and
the item release belong to independent configfs subsystems (most_cdev,
most_net, most_video, most_sound), each with its own su_mutex, and
most_interface_register_notify() - called from interface registration -
holds none of them. So a create_link on one subsystem's item can run
concurrently with a rmdir/destroy_link freeing another subsystem's item
on the same global list, corrupting it, and the register-notify walk can
dereference an entry being freed, giving list corruption / a
use-after-free.

Add a dedicated mutex taken around every mdev_link_list access.

Signed-off-by: Yu Zhang <yuz08559@xxxxxxxxx>
---
 drivers/most/configfs.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/most/configfs.c b/drivers/most/configfs.c
index 8f5158d..307a62c 100644
--- a/drivers/most/configfs.c
+++ b/drivers/most/configfs.c
@@ -34,6 +34,7 @@ struct mdev_link {
 };
 
 static struct list_head mdev_link_list;
+static DEFINE_MUTEX(mdev_link_mutex); /* protects mdev_link_list */
 
 static int set_cfg_buffer_size(struct mdev_link *link)
 {
@@ -125,7 +126,9 @@ static ssize_t mdev_link_create_link_store(struct config_item *item,
 	ret = set_config_and_add_link(mdev_link);
 	if (ret && ret != -ENODEV)
 		return ret;
+	mutex_lock(&mdev_link_mutex);
 	list_add_tail(&mdev_link->list, &mdev_link_list);
+	mutex_unlock(&mdev_link_mutex);
 	mdev_link->create_link = tmp;
 	mdev_link->destroy_link = false;
 
@@ -149,8 +152,10 @@ static ssize_t mdev_link_destroy_link_store(struct config_item *item,
 			       mdev_link->comp);
 	if (ret)
 		return ret;
+	mutex_lock(&mdev_link_mutex);
 	if (!list_empty(&mdev_link_list))
 		list_del(&mdev_link->list);
+	mutex_unlock(&mdev_link_mutex);
 
 	mdev_link->destroy_link = tmp;
 
@@ -392,8 +397,10 @@ static void mdev_link_release(struct config_item *item)
 		goto free_item;
 	}
 
+	mutex_lock(&mdev_link_mutex);
 	if (!list_empty(&mdev_link_list))
 		list_del(&mdev_link->list);
+	mutex_unlock(&mdev_link_mutex);
 
 free_item:
 	kfree(to_mdev_link(item));
@@ -679,6 +686,7 @@ void most_interface_register_notify(const char *mdev)
 	bool register_snd_card = false;
 	struct mdev_link *mdev_link;
 
+	mutex_lock(&mdev_link_mutex);
 	list_for_each_entry(mdev_link, &mdev_link_list, list) {
 		if (!strcmp(mdev_link->device, mdev)) {
 			set_config_and_add_link(mdev_link);
@@ -686,6 +694,7 @@ void most_interface_register_notify(const char *mdev)
 				register_snd_card = true;
 		}
 	}
+	mutex_unlock(&mdev_link_mutex);
 	if (register_snd_card)
 		most_cfg_complete("sound");
 }
-- 
2.43.0