RE: [PATCH] staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl

[Hartley Sweeten]

On Wednesday, October 08, 2014 8:09 AM, Ian Abbott wrote:
> `do_cmd_ioctl()`, the handler for the `COMEDI_CMD` ioctl can incorrectly
> call the Comedi subdevice's `do_cmd()` handler with a NULL channel list
> pointer.  This is a regression as the `do_cmd()` handler has never been
> expected to deal with that, leading to a kernel OOPS when it tries to
> dereference it.
>
> A NULL channel list pointer is allowed for the `COMEDI_CMDTEST` ioctl,
> handled by `do_cmdtest_ioctl()` and the subdevice's `do_cmdtest()`
> handler, but not for the `COMEDI_CMD` ioctl and its handlers.
>
> Both `do_cmd_ioctl()` and `do_cmdtest_ioctl()` call
> `__comedi_get_user_chanlist()` to copy the channel list from user memory
> into dynamically allocated kernel memory and check it for consistency.
> That function currently returns 0 if the `user_chanlist` parameter
> (pointing to the channel list in user memory) is NULL.  That's fine for
> `do_cmdtest_ioctl()`, but `do_cmd_ioctl()` incorrectly assumes the
> kernel copy of the channel list has been set-up correctly.
>
> Fix it by not allowing the `user_chanlist` parameter to be NULL in
> `__comedi_get_user_chanlist()`, and only calling it from
> `do_cmdtest_ioctl()` if the parameter is non-NULL.
>
> Thanks to Bernd Porr for reporting the bug via an initial patch sent
> privately.
>
> Fixes: c6cd0eefb27b ("staging: comedi: comedi_fops: introduce __comedi_get_user_chanlist()")
> Reported-by: Bernd Porr <mail@xxxxxxxxxxxxxxx>
> Signed-off-by: Ian Abbott <abbotti@xxxxxxxxx>
> Cc: Bernd Porr <mail@xxxxxxxxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.15.y 3.16.y 3.17.y
> ---
>  drivers/staging/comedi/comedi_fops.c | 15 +++++++--------
>  1 file changed, 7 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
> index 495969f..a9b7fe5 100644
> --- a/drivers/staging/comedi/comedi_fops.c
> +++ b/drivers/staging/comedi/comedi_fops.c
> @@ -1462,10 +1462,6 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev,
>  	unsigned int *chanlist;
>  	int ret;
>  
> -	/* user_chanlist could be NULL for do_cmdtest ioctls */
> -	if (!user_chanlist)
> -		return 0;
> -

I think you need a check here to avoid a NULL pointer getting
passed to the  memdup_user().

	If (!user_chanlist || cmd->chanlist_len == 0)
		return -EINVAL;

>  	chanlist = memdup_user(user_chanlist,
>  			       cmd->chanlist_len * sizeof(unsigned int));
>  	if (IS_ERR(chanlist))
> @@ -1609,10 +1605,13 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
>  
>  	s = &dev->subdevices[cmd.subdev];
>  
> -	/* load channel/gain list */
> -	ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
> -	if (ret)
> -		return ret;
> +	/* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
> +	if (user_chanlist) {
> +		/* load channel/gain list */
> +		ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
> +		if (ret)
> +			return ret;
> +	}
>
>  	ret = s->do_cmdtest(dev, s, &cmd);
 
The reset looks ok.


Side-note on mem_dupuser(). That function does a kmalloc to copy the
user data to the kernel. Shouldn't we be freeing it when we are done with
it?

do_become_nonbusy() does a kfree(async->cmd.chanlist) which will free
the memory for do_cmd_ioctl().

But, do_cmdtest_ioctl() actually copies the user data into a local variable.
I think we are missing a kfree() there.

Regards,
Hartley

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/