Skip to content

Commit 056e4c6

Browse files
author
Charles Mirabile
committed
firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
JIRA: https://issues.redhat.com/browse/RHEL-113838 CVE: CVE-2022-50087 commit 689640e Author: Sudeep Holla <sudeep.holla@arm.com> Date: Fri, 1 Jul 2022 17:03:10 +0100 When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it is not taken care, then it could result use-after-free as the value is exported via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc() but freed when the probe fails. Link: https://lore.kernel.org/r/20220701160310.148344-1-sudeep.holla@arm.com Cc: stable@vger.kernel.org # 4.19+ Reported-by: huhai <huhai@kylinos.cn> Reviewed-by: Jackie Liu <liuyun01@kylinos.cn> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Charles Mirabile <cmirabil@redhat.com>
1 parent f197184 commit 056e4c6

File tree

1 file changed

+35
-26
lines changed

1 file changed

+35
-26
lines changed

‎drivers/firmware/arm_scpi.c‎

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -815,7 +815,7 @@ static int scpi_init_versions(struct scpi_drvinfo *info)
815815
info->firmware_version = le32_to_cpu(caps.platform_version);
816816
}
817817
/* Ignore error if not implemented */
818-
if (scpi_info->is_legacy && ret == -EOPNOTSUPP)
818+
if (info->is_legacy && ret == -EOPNOTSUPP)
819819
return 0;
820820

821821
return ret;
@@ -911,33 +911,34 @@ static int scpi_probe(struct platform_device *pdev)
911911
struct resource res;
912912
struct device *dev = &pdev->dev;
913913
struct device_node *np = dev->of_node;
914+
struct scpi_drvinfo *scpi_drvinfo;
914915

915-
scpi_info = devm_kzalloc(dev, sizeof(*scpi_info), GFP_KERNEL);
916-
if (!scpi_info)
916+
scpi_drvinfo = devm_kzalloc(dev, sizeof(*scpi_drvinfo), GFP_KERNEL);
917+
if (!scpi_drvinfo)
917918
return -ENOMEM;
918919

919920
if (of_match_device(legacy_scpi_of_match, &pdev->dev))
920-
scpi_info->is_legacy = true;
921+
scpi_drvinfo->is_legacy = true;
921922

922923
count = of_count_phandle_with_args(np, "mboxes", "#mbox-cells");
923924
if (count < 0) {
924925
dev_err(dev, "no mboxes property in '%pOF'\n", np);
925926
return -ENODEV;
926927
}
927928

928-
scpi_info->channels = devm_kcalloc(dev, count, sizeof(struct scpi_chan),
929-
GFP_KERNEL);
930-
if (!scpi_info->channels)
929+
scpi_drvinfo->channels =
930+
devm_kcalloc(dev, count, sizeof(struct scpi_chan), GFP_KERNEL);
931+
if (!scpi_drvinfo->channels)
931932
return -ENOMEM;
932933

933-
ret = devm_add_action(dev, scpi_free_channels, scpi_info);
934+
ret = devm_add_action(dev, scpi_free_channels, scpi_drvinfo);
934935
if (ret)
935936
return ret;
936937

937-
for (; scpi_info->num_chans < count; scpi_info->num_chans++) {
938+
for (; scpi_drvinfo->num_chans < count; scpi_drvinfo->num_chans++) {
938939
resource_size_t size;
939-
int idx = scpi_info->num_chans;
940-
struct scpi_chan *pchan = scpi_info->channels + idx;
940+
int idx = scpi_drvinfo->num_chans;
941+
struct scpi_chan *pchan = scpi_drvinfo->channels + idx;
941942
struct mbox_client *cl = &pchan->cl;
942943
struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
943944

@@ -984,45 +985,53 @@ static int scpi_probe(struct platform_device *pdev)
984985
return ret;
985986
}
986987

987-
scpi_info->commands = scpi_std_commands;
988+
scpi_drvinfo->commands = scpi_std_commands;
988989

989-
platform_set_drvdata(pdev, scpi_info);
990+
platform_set_drvdata(pdev, scpi_drvinfo);
990991

991-
if (scpi_info->is_legacy) {
992+
if (scpi_drvinfo->is_legacy) {
992993
/* Replace with legacy variants */
993994
scpi_ops.clk_set_val = legacy_scpi_clk_set_val;
994-
scpi_info->commands = scpi_legacy_commands;
995+
scpi_drvinfo->commands = scpi_legacy_commands;
995996

996997
/* Fill priority bitmap */
997998
for (idx = 0; idx < ARRAY_SIZE(legacy_hpriority_cmds); idx++)
998999
set_bit(legacy_hpriority_cmds[idx],
999-
scpi_info->cmd_priority);
1000+
scpi_drvinfo->cmd_priority);
10001001
}
10011002

1002-
ret = scpi_init_versions(scpi_info);
1003+
scpi_info = scpi_drvinfo;
1004+
1005+
ret = scpi_init_versions(scpi_drvinfo);
10031006
if (ret) {
10041007
dev_err(dev, "incorrect or no SCP firmware found\n");
1008+
scpi_info = NULL;
10051009
return ret;
10061010
}
10071011

1008-
if (scpi_info->is_legacy && !scpi_info->protocol_version &&
1009-
!scpi_info->firmware_version)
1012+
if (scpi_drvinfo->is_legacy && !scpi_drvinfo->protocol_version &&
1013+
!scpi_drvinfo->firmware_version)
10101014
dev_info(dev, "SCP Protocol legacy pre-1.0 firmware\n");
10111015
else
10121016
dev_info(dev, "SCP Protocol %lu.%lu Firmware %lu.%lu.%lu version\n",
10131017
FIELD_GET(PROTO_REV_MAJOR_MASK,
1014-
scpi_info->protocol_version),
1018+
scpi_drvinfo->protocol_version),
10151019
FIELD_GET(PROTO_REV_MINOR_MASK,
1016-
scpi_info->protocol_version),
1020+
scpi_drvinfo->protocol_version),
10171021
FIELD_GET(FW_REV_MAJOR_MASK,
1018-
scpi_info->firmware_version),
1022+
scpi_drvinfo->firmware_version),
10191023
FIELD_GET(FW_REV_MINOR_MASK,
1020-
scpi_info->firmware_version),
1024+
scpi_drvinfo->firmware_version),
10211025
FIELD_GET(FW_REV_PATCH_MASK,
1022-
scpi_info->firmware_version));
1023-
scpi_info->scpi_ops = &scpi_ops;
1026+
scpi_drvinfo->firmware_version));
1027+
1028+
scpi_drvinfo->scpi_ops = &scpi_ops;
10241029

1025-
return devm_of_platform_populate(dev);
1030+
ret = devm_of_platform_populate(dev);
1031+
if (ret)
1032+
scpi_info = NULL;
1033+
1034+
return ret;
10261035
}
10271036

10281037
static const struct of_device_id scpi_of_match[] = {

0 commit comments

Comments
 (0)