[PATCH v2 1/3] rpmb: core: Pin parent device and guard requests with rwsem

[Stanley Jhu]

When an RPMB device is unregistered, device_del(&rdev->dev) drops the
driver core's reference to the parent device. If external callers still
hold references to rdev, rdev outlives the parent provider (e.g. UFS
host). Once the parent is freed, subsequent access to rdev->dev.parent
causes a Use-After-Free (UAF).

Additionally, lockless access in rpmb_route_frames() races with parent
teardown, risking frame dispatch against an unpowered or torn-down host.

Fix these issues by explicitly pinning the parent device for the
lifetime of the RPMB device, and guarding in-flight requests against
device unregistration with an rw_semaphore teardown barrier.

Fixes: 1e9046e3a154 ("rpmb: add Replay Protected Memory Block (RPMB) subsystem")
Signed-off-by: Stanley Jhu <stanleyjhu@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
Changes in v2:
- New patch in v2 addressing cross-subsystem UAF and TOCTOU races (sashiko-bot).
- Pin parent device with get_device() in register and put_device() in release.
- Introduce rw_semaphore and dead flag to serialize in-flight requests.
 drivers/misc/rpmb-core.c | 24 +++++++++++++++++-------
 include/linux/rpmb.h     |  5 +++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/drivers/misc/rpmb-core.c b/drivers/misc/rpmb-core.c
index ecf14acf230a..c0e19cfe3faa 100644
--- a/drivers/misc/rpmb-core.c
+++ b/drivers/misc/rpmb-core.c
@@ -50,11 +50,21 @@ EXPORT_SYMBOL_GPL(rpmb_dev_put);
 int rpmb_route_frames(struct rpmb_dev *rdev, u8 *req,
 		      unsigned int req_len, u8 *rsp, unsigned int rsp_len)
 {
-	if (!req || !req_len || !rsp || !rsp_len)
+	int ret;
+
+	if (!rdev || !req || !req_len || !rsp || !rsp_len)
 		return -EINVAL;
 
-	return rdev->descr.route_frames(rdev->dev.parent, req, req_len,
-					rsp, rsp_len);
+	down_read(&rdev->lock);
+	if (rdev->dead || !device_is_registered(&rdev->dev)) {
+		up_read(&rdev->lock);
+		return -ENODEV;
+	}
+
+	ret = rdev->descr.route_frames(rdev->dev.parent, req, req_len,
+				       rsp, rsp_len);
+	up_read(&rdev->lock);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(rpmb_route_frames);
 
@@ -62,6 +72,7 @@ static void rpmb_dev_release(struct device *dev)
 {
 	struct rpmb_dev *rdev = to_rpmb_dev(dev);
 
+	put_device(rdev->dev.parent);
 	ida_free(&rpmb_ida, rdev->id);
 	kfree(rdev->descr.dev_id);
 	kfree(rdev);
@@ -133,6 +144,10 @@ int rpmb_dev_unregister(struct rpmb_dev *rdev)
 	if (!rdev)
 		return -EINVAL;
 
+	down_write(&rdev->lock);
+	rdev->dead = true;
+	up_write(&rdev->lock);
+
 	device_del(&rdev->dev);
 
 	rpmb_dev_put(rdev);
@@ -164,6 +179,7 @@ struct rpmb_dev *rpmb_dev_register(struct device *dev,
 	rdev = kzalloc_obj(*rdev);
 	if (!rdev)
 		return ERR_PTR(-ENOMEM);
+	init_rwsem(&rdev->lock);
 	rdev->descr = *descr;
 	rdev->descr.dev_id = kmemdup(descr->dev_id, descr->dev_id_len,
 				     GFP_KERNEL);
@@ -179,7 +195,7 @@ struct rpmb_dev *rpmb_dev_register(struct device *dev,
 
 	dev_set_name(&rdev->dev, "rpmb%d", rdev->id);
 	rdev->dev.class = &rpmb_class;
-	rdev->dev.parent = dev;
+	rdev->dev.parent = get_device(dev);
 
 	ret = device_register(&rdev->dev);
 	if (ret) {
diff --git a/include/linux/rpmb.h b/include/linux/rpmb.h
index ed3f8e431eff..2d8a41716883 100644
--- a/include/linux/rpmb.h
+++ b/include/linux/rpmb.h
@@ -7,6 +7,7 @@
 #define __RPMB_H__
 
 #include <linux/device.h>
+#include <linux/rwsem.h>
 #include <linux/types.h>
 
 /**
@@ -48,15 +49,19 @@ struct rpmb_descr {
  * struct rpmb_dev - device which can support RPMB partition
  *
  * @dev              : device
+ * @lock             : protects in-flight operations against teardown
  * @id               : device_id
  * @list_node        : linked list node
  * @descr            : RPMB description
+ * @dead             : set to true when device is unregistered
  */
 struct rpmb_dev {
 	struct device dev;
+	struct rw_semaphore lock;
 	int id;
 	struct list_head list_node;
 	struct rpmb_descr descr;
+	bool dead;
 };
 
 #define to_rpmb_dev(x)		container_of((x), struct rpmb_dev, dev)
-- 
2.55.0.979.g7e5102b832-goog