Commit d47e3da1 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID fix from Jiri Kosina:
 "A fix for a bug in hid-debug that can lock up the kernel in infinite
  loop (CVE-2019-3819), from Vladis Dronov"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: debug: fix the ring buffer implementation
parents 6f64e3a4 13054abb
...@@ -30,6 +30,7 @@ ...@@ -30,6 +30,7 @@
#include <linux/debugfs.h> #include <linux/debugfs.h>
#include <linux/seq_file.h> #include <linux/seq_file.h>
#include <linux/kfifo.h>
#include <linux/sched/signal.h> #include <linux/sched/signal.h>
#include <linux/export.h> #include <linux/export.h>
#include <linux/slab.h> #include <linux/slab.h>
...@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device); ...@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
/* enqueue string to 'events' ring buffer */ /* enqueue string to 'events' ring buffer */
void hid_debug_event(struct hid_device *hdev, char *buf) void hid_debug_event(struct hid_device *hdev, char *buf)
{ {
unsigned i;
struct hid_debug_list *list; struct hid_debug_list *list;
unsigned long flags; unsigned long flags;
spin_lock_irqsave(&hdev->debug_list_lock, flags); spin_lock_irqsave(&hdev->debug_list_lock, flags);
list_for_each_entry(list, &hdev->debug_list, node) { list_for_each_entry(list, &hdev->debug_list, node)
for (i = 0; buf[i]; i++) kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
buf[i];
list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
}
spin_unlock_irqrestore(&hdev->debug_list_lock, flags); spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
wake_up_interruptible(&hdev->debug_wait); wake_up_interruptible(&hdev->debug_wait);
...@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu ...@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu
hid_debug_event(hdev, buf); hid_debug_event(hdev, buf);
kfree(buf); kfree(buf);
wake_up_interruptible(&hdev->debug_wait); wake_up_interruptible(&hdev->debug_wait);
} }
EXPORT_SYMBOL_GPL(hid_dump_input); EXPORT_SYMBOL_GPL(hid_dump_input);
...@@ -1083,8 +1078,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file) ...@@ -1083,8 +1078,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
goto out; goto out;
} }
if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) { err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
err = -ENOMEM; if (err) {
kfree(list); kfree(list);
goto out; goto out;
} }
...@@ -1104,77 +1099,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, ...@@ -1104,77 +1099,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct hid_debug_list *list = file->private_data; struct hid_debug_list *list = file->private_data;
int ret = 0, len; int ret = 0, copied;
DECLARE_WAITQUEUE(wait, current); DECLARE_WAITQUEUE(wait, current);
mutex_lock(&list->read_mutex); mutex_lock(&list->read_mutex);
while (ret == 0) { if (kfifo_is_empty(&list->hid_debug_fifo)) {
if (list->head == list->tail) { add_wait_queue(&list->hdev->debug_wait, &wait);
add_wait_queue(&list->hdev->debug_wait, &wait); set_current_state(TASK_INTERRUPTIBLE);
set_current_state(TASK_INTERRUPTIBLE);
while (kfifo_is_empty(&list->hid_debug_fifo)) {
while (list->head == list->tail) { if (file->f_flags & O_NONBLOCK) {
if (file->f_flags & O_NONBLOCK) { ret = -EAGAIN;
ret = -EAGAIN; break;
break; }
}
if (signal_pending(current)) {
ret = -ERESTARTSYS;
break;
}
if (!list->hdev || !list->hdev->debug) { if (signal_pending(current)) {
ret = -EIO; ret = -ERESTARTSYS;
set_current_state(TASK_RUNNING); break;
goto out; }
}
/* allow O_NONBLOCK from other threads */ /* if list->hdev is NULL we cannot remove_wait_queue().
mutex_unlock(&list->read_mutex); * if list->hdev->debug is 0 then hid_debug_unregister()
schedule(); * was already called and list->hdev is being destroyed.
mutex_lock(&list->read_mutex); * if we add remove_wait_queue() here we can hit a race.
set_current_state(TASK_INTERRUPTIBLE); */
if (!list->hdev || !list->hdev->debug) {
ret = -EIO;
set_current_state(TASK_RUNNING);
goto out;
} }
set_current_state(TASK_RUNNING); /* allow O_NONBLOCK from other threads */
remove_wait_queue(&list->hdev->debug_wait, &wait); mutex_unlock(&list->read_mutex);
schedule();
mutex_lock(&list->read_mutex);
set_current_state(TASK_INTERRUPTIBLE);
} }
if (ret) __set_current_state(TASK_RUNNING);
goto out; remove_wait_queue(&list->hdev->debug_wait, &wait);
/* pass the ringbuffer contents to userspace */ if (ret)
copy_rest:
if (list->tail == list->head)
goto out; goto out;
if (list->tail > list->head) {
len = list->tail - list->head;
if (len > count)
len = count;
if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
ret = -EFAULT;
goto out;
}
ret += len;
list->head += len;
} else {
len = HID_DEBUG_BUFSIZE - list->head;
if (len > count)
len = count;
if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
ret = -EFAULT;
goto out;
}
list->head = 0;
ret += len;
count -= len;
if (count > 0)
goto copy_rest;
}
} }
/* pass the fifo content to userspace, locking is not needed with only
* one concurrent reader and one concurrent writer
*/
ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
if (ret)
goto out;
ret = copied;
out: out:
mutex_unlock(&list->read_mutex); mutex_unlock(&list->read_mutex);
return ret; return ret;
...@@ -1185,7 +1160,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait) ...@@ -1185,7 +1160,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait)
struct hid_debug_list *list = file->private_data; struct hid_debug_list *list = file->private_data;
poll_wait(file, &list->hdev->debug_wait, wait); poll_wait(file, &list->hdev->debug_wait, wait);
if (list->head != list->tail) if (!kfifo_is_empty(&list->hid_debug_fifo))
return EPOLLIN | EPOLLRDNORM; return EPOLLIN | EPOLLRDNORM;
if (!list->hdev->debug) if (!list->hdev->debug)
return EPOLLERR | EPOLLHUP; return EPOLLERR | EPOLLHUP;
...@@ -1200,7 +1175,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file) ...@@ -1200,7 +1175,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
spin_lock_irqsave(&list->hdev->debug_list_lock, flags); spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
list_del(&list->node); list_del(&list->node);
spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags); spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
kfree(list->hid_debug_buf); kfifo_free(&list->hid_debug_fifo);
kfree(list); kfree(list);
return 0; return 0;
...@@ -1246,4 +1221,3 @@ void hid_debug_exit(void) ...@@ -1246,4 +1221,3 @@ void hid_debug_exit(void)
{ {
debugfs_remove_recursive(hid_debug_root); debugfs_remove_recursive(hid_debug_root);
} }
...@@ -24,7 +24,10 @@ ...@@ -24,7 +24,10 @@
#ifdef CONFIG_DEBUG_FS #ifdef CONFIG_DEBUG_FS
#include <linux/kfifo.h>
#define HID_DEBUG_BUFSIZE 512 #define HID_DEBUG_BUFSIZE 512
#define HID_DEBUG_FIFOSIZE 512
void hid_dump_input(struct hid_device *, struct hid_usage *, __s32); void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
void hid_dump_report(struct hid_device *, int , u8 *, int); void hid_dump_report(struct hid_device *, int , u8 *, int);
...@@ -37,11 +40,8 @@ void hid_debug_init(void); ...@@ -37,11 +40,8 @@ void hid_debug_init(void);
void hid_debug_exit(void); void hid_debug_exit(void);
void hid_debug_event(struct hid_device *, char *); void hid_debug_event(struct hid_device *, char *);
struct hid_debug_list { struct hid_debug_list {
char *hid_debug_buf; DECLARE_KFIFO_PTR(hid_debug_fifo, char);
int head;
int tail;
struct fasync_struct *fasync; struct fasync_struct *fasync;
struct hid_device *hdev; struct hid_device *hdev;
struct list_head node; struct list_head node;
...@@ -64,4 +64,3 @@ struct hid_debug_list { ...@@ -64,4 +64,3 @@ struct hid_debug_list {
#endif #endif
#endif #endif
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment