hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux-sg2042/drivers/input/rmi4
History
Nick Desaulniers 55edde9fff Input: synaptics-rmi4 - prevent UAF reported by KASAN 
KASAN found a UAF due to dangling pointer. As the report below says,
rmi_f11_attention() accesses drvdata->attn_data.data, which was freed in
rmi_irq_fn.

[  311.424062] BUG: KASAN: use-after-free in rmi_f11_attention+0x526/0x5e0 [rmi_core]
[  311.424067] Read of size 27 at addr ffff88041fd610db by task irq/131-i2c_hid/1162
[  311.424075] CPU: 0 PID: 1162 Comm: irq/131-i2c_hid Not tainted 4.15.0-rc8+ #2
[  311.424076] Hardware name: Razer Blade Stealth/Razer, BIOS 6.05 01/26/2017
[  311.424078] Call Trace:
[  311.424086]  dump_stack+0xae/0x12d
[  311.424090]  ? _atomic_dec_and_lock+0x103/0x103
[  311.424094]  ? show_regs_print_info+0xa/0xa
[  311.424099]  ? input_handle_event+0x10b/0x810
[  311.424104]  print_address_description+0x65/0x229
[  311.424108]  kasan_report.cold.5+0xa7/0x281
[  311.424117]  rmi_f11_attention+0x526/0x5e0 [rmi_core]
[  311.424123]  ? memcpy+0x1f/0x50
[  311.424132]  ? rmi_f11_attention+0x526/0x5e0 [rmi_core]
[  311.424143]  ? rmi_f11_probe+0x1e20/0x1e20 [rmi_core]
[  311.424153]  ? rmi_process_interrupt_requests+0x220/0x2a0 [rmi_core]
[  311.424163]  ? rmi_irq_fn+0x22c/0x270 [rmi_core]
[  311.424173]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
[  311.424177]  ? free_irq+0xa0/0xa0
[  311.424180]  ? irq_finalize_oneshot.part.39+0xeb/0x180
[  311.424190]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
[  311.424193]  ? irq_thread_fn+0x3d/0x80
[  311.424197]  ? irq_finalize_oneshot.part.39+0x180/0x180
[  311.424200]  ? irq_thread+0x21d/0x290
[  311.424203]  ? irq_thread_check_affinity+0x170/0x170
[  311.424207]  ? remove_wait_queue+0x150/0x150
[  311.424212]  ? kasan_unpoison_shadow+0x30/0x40
[  311.424214]  ? __init_waitqueue_head+0xa0/0xd0
[  311.424218]  ? task_non_contending.cold.55+0x18/0x18
[  311.424221]  ? irq_forced_thread_fn+0xa0/0xa0
[  311.424226]  ? irq_thread_check_affinity+0x170/0x170
[  311.424230]  ? kthread+0x19e/0x1c0
[  311.424233]  ? kthread_create_worker_on_cpu+0xc0/0xc0
[  311.424237]  ? ret_from_fork+0x32/0x40

[  311.424244] Allocated by task 899:
[  311.424249]  kasan_kmalloc+0xbf/0xe0
[  311.424252]  __kmalloc_track_caller+0xd9/0x1f0
[  311.424255]  kmemdup+0x17/0x40
[  311.424264]  rmi_set_attn_data+0xa4/0x1b0 [rmi_core]
[  311.424269]  rmi_raw_event+0x10b/0x1f0 [hid_rmi]
[  311.424278]  hid_input_report+0x1a8/0x2c0 [hid]
[  311.424283]  i2c_hid_irq+0x146/0x1d0 [i2c_hid]
[  311.424286]  irq_thread_fn+0x3d/0x80
[  311.424288]  irq_thread+0x21d/0x290
[  311.424291]  kthread+0x19e/0x1c0
[  311.424293]  ret_from_fork+0x32/0x40

[  311.424296] Freed by task 1162:
[  311.424300]  kasan_slab_free+0x71/0xc0
[  311.424303]  kfree+0x90/0x190
[  311.424311]  rmi_irq_fn+0x1b2/0x270 [rmi_core]
[  311.424319]  rmi_irq_fn+0x257/0x270 [rmi_core]
[  311.424322]  irq_thread_fn+0x3d/0x80
[  311.424324]  irq_thread+0x21d/0x290
[  311.424327]  kthread+0x19e/0x1c0
[  311.424330]  ret_from_fork+0x32/0x40

[  311.424334] The buggy address belongs to the object at ffff88041fd610c0 which belongs to the cache kmalloc-64 of size 64
[  311.424340] The buggy address is located 27 bytes inside of 64-byte region [ffff88041fd610c0, ffff88041fd61100)
[  311.424344] The buggy address belongs to the page:
[  311.424348] page:ffffea00107f5840 count:1 mapcount:0 mapping: (null) index:0x0
[  311.424353] flags: 0x17ffffc0000100(slab)
[  311.424358] raw: 0017ffffc0000100 0000000000000000 0000000000000000 00000001802a002a
[  311.424363] raw: dead000000000100 dead000000000200 ffff8804228036c0 0000000000000000
[  311.424366] page dumped because: kasan: bad access detected

[  311.424369] Memory state around the buggy address:
[  311.424373]  ffff88041fd60f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  311.424377]  ffff88041fd61000: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
[  311.424381] >ffff88041fd61080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
[  311.424384]                                                     ^
[  311.424387]  ffff88041fd61100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
[  311.424391]  ffff88041fd61180: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb

Cc: stable@vger.kernel.org
Signed-off-by: Nick Desaulniers <nick.desaulniers@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 		2018-01-18 11:40:13 -08:00
..
Kconfig Merge branch 'next' into for-linus 2017-02-20 15:16:02 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rmi_2d_sensor.c Input: synaptics-rmi4 - correctly swap clip values if axes are swapped 2017-01-15 15:41:00 -08:00
rmi_2d_sensor.h Input: synaptics-rmi4 - add parameters for dribble packets and palm detect gesture 2016-11-08 17:12:07 -08:00
rmi_bus.c Merge branch 'synaptics-rmi4' into next 2017-02-06 14:17:39 -08:00
rmi_bus.h Input: synaptics-rmi4 - add SMBus support 2016-11-08 17:12:10 -08:00
rmi_driver.c Input: synaptics-rmi4 - prevent UAF reported by KASAN 2018-01-18 11:40:13 -08:00
rmi_driver.h Input: synaptics-rmi4 - forward upper mechanical buttons to PS/2 guest 2017-02-09 13:01:34 -08:00
rmi_f01.c Merge branch 'bind_unbind' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core into next 2017-07-24 16:51:18 -07:00
rmi_f03.c Input: synaptics-rmi4 - register F03 port as pass-through serio 2017-06-09 09:57:19 -07:00
rmi_f11.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2016-12-17 16:45:00 -08:00
rmi_f12.c Input: synaptics-rmi4 - change F12 clip to inactive border debug 2017-04-14 14:52:31 -07:00
rmi_f30.c Input: synaptics-rmi4 - limit the range of what GPIOs are buttons 2017-10-27 15:15:59 -07:00
rmi_f34.c Input: synaptics-rmi4 - constify attribute_group structures in F34 2017-07-12 14:18:27 -07:00
rmi_f34.h Input: synaptics-rmi4 - enable IRQ operation in F34 V7 2017-04-14 14:52:32 -07:00
rmi_f34v7.c Input: synaptics-rmi4 - use %phN to form F34 configuration ID 2017-06-01 22:11:23 -07:00
rmi_f54.c Input: synaptics-rmi4 - make array rmi_f54_report_type_names static 2017-10-09 20:53:36 -07:00
rmi_f55.c Input: synaptics-rmi4 - propagate correct number of rx and tx electrodes to F54 2016-11-22 17:59:25 -08:00
rmi_i2c.c Input: synaptics-rmi4 - when registering sensors do not call them "drivers" 2017-04-03 16:24:00 -07:00
rmi_smbus.c Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3 2017-11-07 17:45:07 -08:00
rmi_spi.c Input: synaptics-rmi4 - when registering sensors do not call them "drivers" 2017-04-03 16:24:00 -07:00