Commit 5a96b2d3 authored by Ben Wolsieffer's avatar Ben Wolsieffer Committed by Greg Kroah-Hartman

staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION

The compatibility ioctl wrapper for VCHIQ_IOC_AWAIT_COMPLETION assumes that
the native ioctl always uses a message buffer and decrements msgbufcount.
Certain message types do not use a message buffer and in this case
msgbufcount is not decremented, and completion->header for the message is
NULL. Because the wrapper unconditionally decrements msgbufcount, the
calling process may assume that a message buffer has been used even when
it has not.

This results in a memory leak in the userspace code that interfaces with
this driver. When msgbufcount is decremented, the userspace code assumes
that the buffer can be freed though the reference in completion->header,
which cannot happen when the reference is NULL.

This patch causes the wrapper to only decrement msgbufcount when the
native ioctl decrements it. Note that we cannot simply copy the native
ioctl's value of msgbufcount, because the wrapper only retrieves messages
from the native ioctl one at a time, while userspace may request multiple
messages.

See https://github.com/raspberrypi/linux/pull/2703 for more discussion of
this patch.

Fixes: 5569a126 ("staging: vchiq_arm: Add compatibility wrappers for ioctls")
Signed-off-by: default avatarBen Wolsieffer <benwolsieffer@gmail.com>
Acked-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cd56a514
...@@ -1795,6 +1795,7 @@ vchiq_compat_ioctl_await_completion(struct file *file, ...@@ -1795,6 +1795,7 @@ vchiq_compat_ioctl_await_completion(struct file *file,
struct vchiq_await_completion32 args32; struct vchiq_await_completion32 args32;
struct vchiq_completion_data32 completion32; struct vchiq_completion_data32 completion32;
unsigned int *msgbufcount32; unsigned int *msgbufcount32;
unsigned int msgbufcount_native;
compat_uptr_t msgbuf32; compat_uptr_t msgbuf32;
void *msgbuf; void *msgbuf;
void **msgbufptr; void **msgbufptr;
...@@ -1906,7 +1907,11 @@ vchiq_compat_ioctl_await_completion(struct file *file, ...@@ -1906,7 +1907,11 @@ vchiq_compat_ioctl_await_completion(struct file *file,
sizeof(completion32))) sizeof(completion32)))
return -EFAULT; return -EFAULT;
args32.msgbufcount--; if (get_user(msgbufcount_native, &args->msgbufcount))
return -EFAULT;
if (!msgbufcount_native)
args32.msgbufcount--;
msgbufcount32 = msgbufcount32 =
&((struct vchiq_await_completion32 __user *)arg)->msgbufcount; &((struct vchiq_await_completion32 __user *)arg)->msgbufcount;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment