Files
linux/include/net
Lin Ma 2350cffd71 NFC: add NCI_UNREG flag to eliminate the race
commit 48b71a9e66 upstream.

There are two sites that calls queue_work() after the
destroy_workqueue() and lead to possible UAF.

The first site is nci_send_cmd(), which can happen after the
nci_close_device as below

nfcmrvl_nci_unregister_dev   |  nfc_genl_dev_up
  nci_close_device           |
    flush_workqueue          |
    del_timer_sync           |
  nci_unregister_device      |    nfc_get_device
    destroy_workqueue        |    nfc_dev_up
    nfc_unregister_device    |      nci_dev_up
      device_del             |        nci_open_device
                             |          __nci_request
                             |            nci_send_cmd
                             |              queue_work !!!

Another site is nci_cmd_timer, awaked by the nci_cmd_work from the
nci_send_cmd.

  ...                        |  ...
  nci_unregister_device      |  queue_work
    destroy_workqueue        |
    nfc_unregister_device    |  ...
      device_del             |  nci_cmd_work
                             |  mod_timer
                             |  ...
                             |  nci_cmd_timer
                             |    queue_work !!!

For the above two UAF, the root cause is that the nfc_dev_up can race
between the nci_unregister_device routine. Therefore, this patch
introduce NCI_UNREG flag to easily eliminate the possible race. In
addition, the mutex_lock in nci_close_device can act as a barrier.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation")
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20211116152732.19238-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-01 09:27:43 +01:00
..
2019-07-03 13:14:42 +02:00
2021-06-10 13:24:06 +02:00
2019-03-23 20:09:51 +01:00
2019-02-23 09:07:27 +01:00
2016-07-08 12:20:57 +02:00
2016-04-25 16:44:27 -04:00
2016-04-25 16:44:27 -04:00
2018-02-28 11:43:28 -05:00
2019-11-10 11:27:54 +01:00
2020-07-22 09:31:58 +02:00
2017-12-11 14:10:06 -05:00
2016-08-17 19:36:23 -04:00
2021-08-04 12:23:46 +02:00
2018-06-18 22:40:32 +02:00
2016-10-03 02:00:22 -04:00
2018-04-07 22:32:31 -04:00
2017-11-08 16:12:33 +09:00
2018-05-16 07:23:35 +02:00
2018-05-16 07:23:35 +02:00
2018-06-22 13:43:27 +09:00
2018-06-22 13:43:27 +09:00
2018-04-17 13:53:13 -04:00