3e3b5dfcd1
There is a potential UAF between the unregistration routine and the NFC
netlink operations.
The race that cause that UAF can be shown as below:
(FREE) | (USE)
nfcmrvl_nci_unregister_dev | nfc_genl_dev_up
nci_close_device |
nci_unregister_device | nfc_get_device
nfc_unregister_device | nfc_dev_up
rfkill_destory |
device_del | rfkill_blocked
... | ...
The root cause for this race is concluded below:
1. The rfkill_blocked (USE) in nfc_dev_up is supposed to be placed after
the device_is_registered check.
2. Since the netlink operations are possible just after the device_add
in nfc_register_device, the nfc_dev_up() can happen anywhere during the
rfkill creation process, which leads to data race.
This patch reorder these actions to permit
1. Once device_del is finished, the nfc_dev_up cannot dereference the
rfkill object.
2. The rfkill_register need to be placed after the device_add of nfc_dev
because the parent device need to be created first. So this patch keeps
the order but inject device_lock to prevent the data race.
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes:
|
||
|---|---|---|
| .. | ||
| hci | ||
| nci | ||
| af_nfc.c | ||
| core.c | ||
| digital_core.c | ||
| digital_dep.c | ||
| digital_technology.c | ||
| digital.h | ||
| Kconfig | ||
| llcp_commands.c | ||
| llcp_core.c | ||
| llcp_sock.c | ||
| llcp.h | ||
| Makefile | ||
| netlink.c | ||
| nfc.h | ||
| rawsock.c | ||