Messages in this thread Patch in this message |  | | From | Duoming Zhou <> | Subject | [PATCH] drivers: nfc: nfcmrvl: fix double free bug in nfcmrvl_nci_unregister_dev() | Date | Sun, 10 Apr 2022 16:31:25 +0800 |
| |
There is a potential double bug in nfcmrvl usb driver between unregister and resume operation.
The race that cause that double free bug can be shown as below:
(FREE) | (USE) | nfcmrvl_resume | nfcmrvl_submit_bulk_urb | nfcmrvl_bulk_complete | nfcmrvl_nci_recv_frame | nfcmrvl_fw_dnld_recv_frame | queue_work | fw_dnld_rx_work | fw_dnld_over | release_firmware | kfree(fw); //(1) nfcmrvl_disconnect | nfcmrvl_nci_unregister_dev | nfcmrvl_fw_dnld_abort | fw_dnld_over | ... if (priv->fw_dnld.fw) | release_firmware | kfree(fw); //(2) | ... | fw = NULL;
When nfcmrvl usb driver is resuming, we detach the device. The release_firmware() will deallocate firmware in position (1), but firmware will be deallocated again in position (2), which leads to double free.
This patch reorders nfcmrvl_fw_dnld_deinit() before nfcmrvl_fw_dnld_abort() in order to prevent double free bug. Because destroy_workqueue() will not return until all work is finished.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/nfc/nfcmrvl/main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c index 2fcf545012b..d8342271f50 100644 --- a/drivers/nfc/nfcmrvl/main.c +++ b/drivers/nfc/nfcmrvl/main.c @@ -183,11 +183,10 @@ void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv) { struct nci_dev *ndev = priv->ndev; + nfcmrvl_fw_dnld_deinit(priv); if (priv->ndev->nfc_dev->fw_download_in_progress) nfcmrvl_fw_dnld_abort(priv); - nfcmrvl_fw_dnld_deinit(priv); - if (gpio_is_valid(priv->config.reset_n_io)) gpio_free(priv->config.reset_n_io); -- 2.17.1
|  |