[PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()

[PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()

[Chengfeng Ye]

&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/firewire/core-cdev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 9f89c17730b1..2f47e31918f0 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1516,9 +1516,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
 	}
 	e->phy_packet.data[0] = packet->timestamp;
 
+	struct client *e_client = e->client;
 	queue_event(e->client, &e->event, &e->phy_packet,
 		    sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
-	client_put(e->client);
+	client_put(e_client);
 }
 
 static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
-- 
2.17.1

Re: [PATCH] firewire: fix potential uaf in outbound_phy_packet_callback()

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 3152 bytes --]

Hi Chengfeng,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on ieee1394-linux1394/for-next]
[also build test WARNING on v5.15 next-20211104]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Chengfeng-Ye/firewire-fix-potential-uaf-in-outbound_phy_packet_callback/20211104-233441
base:   https://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394.git for-next
config: x86_64-randconfig-r034-20211105 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 847a6807332b13f43704327c2d30103ec0347c77)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/4374c2eea7055a681ca81f925ded194d11062af6
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Chengfeng-Ye/firewire-fix-potential-uaf-in-outbound_phy_packet_callback/20211104-233441
        git checkout 4374c2eea7055a681ca81f925ded194d11062af6
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=x86_64 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

>> drivers/firewire/core-cdev.c:1499:17: warning: ISO C90 forbids mixing declarations and code [-Wdeclaration-after-statement]
           struct client *e_client = e->client;
                          ^
   1 warning generated.


vim +1499 drivers/firewire/core-cdev.c

  1477	
  1478	static void outbound_phy_packet_callback(struct fw_packet *packet,
  1479						 struct fw_card *card, int status)
  1480	{
  1481		struct outbound_phy_packet_event *e =
  1482			container_of(packet, struct outbound_phy_packet_event, p);
  1483	
  1484		switch (status) {
  1485		/* expected: */
  1486		case ACK_COMPLETE:	e->phy_packet.rcode = RCODE_COMPLETE;	break;
  1487		/* should never happen with PHY packets: */
  1488		case ACK_PENDING:	e->phy_packet.rcode = RCODE_COMPLETE;	break;
  1489		case ACK_BUSY_X:
  1490		case ACK_BUSY_A:
  1491		case ACK_BUSY_B:	e->phy_packet.rcode = RCODE_BUSY;	break;
  1492		case ACK_DATA_ERROR:	e->phy_packet.rcode = RCODE_DATA_ERROR;	break;
  1493		case ACK_TYPE_ERROR:	e->phy_packet.rcode = RCODE_TYPE_ERROR;	break;
  1494		/* stale generation; cancelled; on certain controllers: no ack */
  1495		default:		e->phy_packet.rcode = status;		break;
  1496		}
  1497		e->phy_packet.data[0] = packet->timestamp;
  1498	
> 1499		struct client *e_client = e->client;
  1500		queue_event(e->client, &e->event, &e->phy_packet,
  1501			    sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
  1502		client_put(e_client);
  1503	}
  1504	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 31912 bytes --]