[PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[Tzung-Bi Shih]

cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
calls iio_push_to_buffers_with_timestamp() without making sure the
`indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
buffer mode right before cros_ec_sensors_push_data() accesses them.

An use-after-free on `indio_dev->active_scan_mask` was observed.  The
call trace:
[...]
 _find_next_bit
 cros_ec_sensors_push_data
 cros_ec_sensorhub_event
 blocking_notifier_call_chain
 cros_ec_irq_thread

It was caused by a race condition: one thread just freed
`active_scan_mask` at [1]; while another thread tried to access the
memory at [2].

Fix it by calling iio_device_claim_buffer_mode() to ensure the
`indio_dev` can't exit buffer mode during cros_ec_sensors_push_data().

[1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189
[2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198

Cc: stable@vger.kernel.org
Fixes: aa984f1ba4a4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
Changes from v1(https://patchwork.kernel.org/project/linux-iio/patch/20230828094339.1248472-1-tzungbi@kernel.org/):
- Use iio_device_{claim|release}_buffer_mode() instead of accessing `mlock`.

 drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
index b72d39fc2434..6bfe5d6847e7 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
@@ -190,8 +190,11 @@ int cros_ec_sensors_push_data(struct iio_dev *indio_dev,
 	/*
 	 * Ignore samples if the buffer is not set: it is needed if the ODR is
 	 * set but the buffer is not enabled yet.
+	 *
+	 * Note: iio_device_claim_buffer_mode() returns -EBUSY if the buffer
+	 * is not enabled.
 	 */
-	if (!iio_buffer_enabled(indio_dev))
+	if (iio_device_claim_buffer_mode(indio_dev) < 0)
 		return 0;
 
 	out = (s16 *)st->samples;
@@ -210,6 +213,7 @@ int cros_ec_sensors_push_data(struct iio_dev *indio_dev,
 	iio_push_to_buffers_with_timestamp(indio_dev, st->samples,
 					   timestamp + delta);
 
+	iio_device_release_buffer_mode(indio_dev);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(cros_ec_sensors_push_data);
-- 
2.42.0.rc2.253.gd59a3bf2b4-goog

Re: [PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[Stephen Boyd]

Quoting Tzung-Bi Shih (2023-08-28 20:06:22)
> cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
> calls iio_push_to_buffers_with_timestamp() without making sure the
> `indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
> buffer mode right before cros_ec_sensors_push_data() accesses them.
>
> An use-after-free on `indio_dev->active_scan_mask` was observed.  The
> call trace:
> [...]
>  _find_next_bit
>  cros_ec_sensors_push_data
>  cros_ec_sensorhub_event
>  blocking_notifier_call_chain
>  cros_ec_irq_thread
>
> It was caused by a race condition: one thread just freed
> `active_scan_mask` at [1]; while another thread tried to access the
> memory at [2].
>
> Fix it by calling iio_device_claim_buffer_mode() to ensure the
> `indio_dev` can't exit buffer mode during cros_ec_sensors_push_data().
>
> [1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189
> [2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198
>
> Cc: stable@vger.kernel.org
> Fixes: aa984f1ba4a4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO")
> Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
> ---

Reviewed-by: Stephen Boyd <swboyd@chromium.org>

Re: [PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[Guenter Roeck]

On Mon, Aug 28, 2023 at 8:06 PM Tzung-Bi Shih <tzungbi@kernel.org> wrote:
>
> cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
> calls iio_push_to_buffers_with_timestamp() without making sure the
> `indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
> buffer mode right before cros_ec_sensors_push_data() accesses them.
>
> An use-after-free on `indio_dev->active_scan_mask` was observed.  The
> call trace:
> [...]
>  _find_next_bit
>  cros_ec_sensors_push_data
>  cros_ec_sensorhub_event
>  blocking_notifier_call_chain
>  cros_ec_irq_thread
>
> It was caused by a race condition: one thread just freed
> `active_scan_mask` at [1]; while another thread tried to access the
> memory at [2].
>
> Fix it by calling iio_device_claim_buffer_mode() to ensure the
> `indio_dev` can't exit buffer mode during cros_ec_sensors_push_data().
>
> [1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189
> [2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198
>
> Cc: stable@vger.kernel.org
> Fixes: aa984f1ba4a4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO")
> Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>

Reviewed-by: Guenter Roeck <groeck@chromium.org>

> ---
> Changes from v1(https://patchwork.kernel.org/project/linux-iio/patch/20230828094339.1248472-1-tzungbi@kernel.org/):
> - Use iio_device_{claim|release}_buffer_mode() instead of accessing `mlock`.
>
>  drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> index b72d39fc2434..6bfe5d6847e7 100644
> --- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> +++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> @@ -190,8 +190,11 @@ int cros_ec_sensors_push_data(struct iio_dev *indio_dev,
>         /*
>          * Ignore samples if the buffer is not set: it is needed if the ODR is
>          * set but the buffer is not enabled yet.
> +        *
> +        * Note: iio_device_claim_buffer_mode() returns -EBUSY if the buffer
> +        * is not enabled.
>          */
> -       if (!iio_buffer_enabled(indio_dev))
> +       if (iio_device_claim_buffer_mode(indio_dev) < 0)
>                 return 0;
>
>         out = (s16 *)st->samples;
> @@ -210,6 +213,7 @@ int cros_ec_sensors_push_data(struct iio_dev *indio_dev,
>         iio_push_to_buffers_with_timestamp(indio_dev, st->samples,
>                                            timestamp + delta);
>
> +       iio_device_release_buffer_mode(indio_dev);
>         return 0;
>  }
>  EXPORT_SYMBOL_GPL(cros_ec_sensors_push_data);
> --
> 2.42.0.rc2.253.gd59a3bf2b4-goog
>

Re: [PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[Jonathan Cameron]

On Tue, 29 Aug 2023 13:50:59 -0700
Guenter Roeck <groeck@google.com> wrote:

> On Mon, Aug 28, 2023 at 8:06 PM Tzung-Bi Shih <tzungbi@kernel.org> wrote:
> >
> > cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
> > calls iio_push_to_buffers_with_timestamp() without making sure the
> > `indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
> > buffer mode right before cros_ec_sensors_push_data() accesses them.
> >
> > An use-after-free on `indio_dev->active_scan_mask` was observed.  The
> > call trace:
> > [...]
> >  _find_next_bit
> >  cros_ec_sensors_push_data
> >  cros_ec_sensorhub_event
> >  blocking_notifier_call_chain
> >  cros_ec_irq_thread
> >
> > It was caused by a race condition: one thread just freed
> > `active_scan_mask` at [1]; while another thread tried to access the
> > memory at [2].
> >
> > Fix it by calling iio_device_claim_buffer_mode() to ensure the
> > `indio_dev` can't exit buffer mode during cros_ec_sensors_push_data().
> >
> > [1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189
> > [2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198
> >
> > Cc: stable@vger.kernel.org
> > Fixes: aa984f1ba4a4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO")
> > Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>  
> 
> Reviewed-by: Guenter Roeck <groeck@chromium.org>
Applied to the fixes-togreg branch of iio.git.  Note I'll be rebasing that tree on rc1 before
I send a pull request. So this will take a week or two to go upstream.

Thanks,

Jonathan
> 
> > ---
> > Changes from v1(https://patchwork.kernel.org/project/linux-iio/patch/20230828094339.1248472-1-tzungbi@kernel.org/):
> > - Use iio_device_{claim|release}_buffer_mode() instead of accessing `mlock`.
> >
> >  drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> > index b72d39fc2434..6bfe5d6847e7 100644
> > --- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> > +++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> > @@ -190,8 +190,11 @@ int cros_ec_sensors_push_data(struct iio_dev *indio_dev,
> >         /*
> >          * Ignore samples if the buffer is not set: it is needed if the ODR is
> >          * set but the buffer is not enabled yet.
> > +        *
> > +        * Note: iio_device_claim_buffer_mode() returns -EBUSY if the buffer
> > +        * is not enabled.
> >          */
> > -       if (!iio_buffer_enabled(indio_dev))
> > +       if (iio_device_claim_buffer_mode(indio_dev) < 0)
> >                 return 0;
> >
> >         out = (s16 *)st->samples;
> > @@ -210,6 +213,7 @@ int cros_ec_sensors_push_data(struct iio_dev *indio_dev,
> >         iio_push_to_buffers_with_timestamp(indio_dev, st->samples,
> >                                            timestamp + delta);
> >
> > +       iio_device_release_buffer_mode(indio_dev);
> >         return 0;
> >  }
> >  EXPORT_SYMBOL_GPL(cros_ec_sensors_push_data);
> > --
> > 2.42.0.rc2.253.gd59a3bf2b4-goog
> >  

Re: [PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[patchwork-bot+chrome-platform]

Hello:

This patch was applied to chrome-platform/linux.git (for-kernelci)
by Jonathan Cameron <Jonathan.Cameron@huawei.com>:

On Tue, 29 Aug 2023 11:06:22 +0800 you wrote:
> cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
> calls iio_push_to_buffers_with_timestamp() without making sure the
> `indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
> buffer mode right before cros_ec_sensors_push_data() accesses them.
> 
> An use-after-free on `indio_dev->active_scan_mask` was observed.  The
> call trace:
> [...]
>  _find_next_bit
>  cros_ec_sensors_push_data
>  cros_ec_sensorhub_event
>  blocking_notifier_call_chain
>  cros_ec_irq_thread
> 
> [...]

Here is the summary with links:
  - [v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()
    https://git.kernel.org/chrome-platform/c/7771c8c80d62

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()

[patchwork-bot+chrome-platform]

Hello:

This patch was applied to chrome-platform/linux.git (for-next)
by Jonathan Cameron <Jonathan.Cameron@huawei.com>:

On Tue, 29 Aug 2023 11:06:22 +0800 you wrote:
> cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and
> calls iio_push_to_buffers_with_timestamp() without making sure the
> `indio_dev` stays in buffer mode.  There is a race if `indio_dev` exits
> buffer mode right before cros_ec_sensors_push_data() accesses them.
> 
> An use-after-free on `indio_dev->active_scan_mask` was observed.  The
> call trace:
> [...]
>  _find_next_bit
>  cros_ec_sensors_push_data
>  cros_ec_sensorhub_event
>  blocking_notifier_call_chain
>  cros_ec_irq_thread
> 
> [...]

Here is the summary with links:
  - [v2] iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()
    https://git.kernel.org/chrome-platform/c/7771c8c80d62

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html