| From 2cb4e7a505d3b6ee61c4f77fb06778c55c5c49cf Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 27 Apr 2020 18:08:58 -0700 |
| Subject: Input: synaptics-rmi4 - really fix attn_data use-after-free |
| |
| From: Evan Green <evgreen@chromium.org> |
| |
| [ Upstream commit d5a5e5b5fa7b86c05bf073acc0ba98fa280174ec ] |
| |
| Fix a use-after-free noticed by running with KASAN enabled. If |
| rmi_irq_fn() is run twice in a row, then rmi_f11_attention() (among |
| others) will end up reading from drvdata->attn_data.data, which was |
| freed and left dangling in rmi_irq_fn(). |
| |
| Commit 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by |
| KASAN") correctly identified and analyzed this bug. However the attempted |
| fix only NULLed out a local variable, missing the fact that |
| drvdata->attn_data is a struct, not a pointer. |
| |
| NULL out the correct pointer in the driver data to prevent the attention |
| functions from copying from it. |
| |
| Fixes: 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by KASAN") |
| Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data") |
| Signed-off-by: Evan Green <evgreen@chromium.org> |
| Cc: stable@vger.kernel.org |
| Link: https://lore.kernel.org/r/20200427145537.1.Ic8f898e0147beeee2c005ee7b20f1aebdef1e7eb@changeid |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/input/rmi4/rmi_driver.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c |
| index 997ccae7ee05..633fd0d660c1 100644 |
| --- a/drivers/input/rmi4/rmi_driver.c |
| +++ b/drivers/input/rmi4/rmi_driver.c |
| @@ -232,7 +232,7 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id) |
| |
| if (count) { |
| kfree(attn_data.data); |
| - attn_data.data = NULL; |
| + drvdata->attn_data.data = NULL; |
| } |
| |
| if (!kfifo_is_empty(&drvdata->attn_fifo)) |
| -- |
| 2.25.1 |
| |
