From ed97e9cf1d7ef8b9c5d34f40db1b32bfce0ce6f4 Mon Sep 17 00:00:00 2001 From: Daniel Perez-Zoghbi Date: Mon, 22 Jul 2024 16:13:32 -0700 Subject: [PATCH] qcedev: fix UAF in qcedev_smmu External researcher found UAF in qcedev_smmu.c on an error condition in qcedev_check_and_map_buffer. When an error occurs, we free binfo, but it is still kept in the registeredbufs list. The fix removes it from the list before freeing binfo. Change-Id: I0327e456bd46106b12c36a5a21305407aae428dd Signed-off-by: Daniel Perez-Zoghbi --- drivers/crypto/msm/qcedev_smmu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/msm/qcedev_smmu.c b/drivers/crypto/msm/qcedev_smmu.c index 50cd945b0c73..8d4844becc85 100644 --- a/drivers/crypto/msm/qcedev_smmu.c +++ b/drivers/crypto/msm/qcedev_smmu.c @@ -350,8 +350,12 @@ int qcedev_check_and_map_buffer(void *handle, return 0; unmap: - if (!found) + if (!found) { qcedev_unmap_buffer(handle, mem_client, binfo); + mutex_lock(&qce_hndl->registeredbufs.lock); + list_del(&binfo->list); + mutex_unlock(&qce_hndl->registeredbufs.lock); + } error: kfree(binfo);