Skip to content

Commit 57c5f4d

Browse files
lxbszgregkh
lxbsz
authored and
gregkh
committed
uio: fix crash after the device is unregistered
For the target_core_user use case, after the device is unregistered it maybe still opened in user space, then the kernel will crash, like: [ 251.163692] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 251.163820] IP: [<ffffffffc0736213>] show_name+0x23/0x40 [uio] [ 251.163965] PGD 8000000062694067 PUD 62696067 PMD 0 [ 251.164097] Oops: 0000 [#1] SMP ... [ 251.165605] e1000 mptscsih mptbase drm_panel_orientation_quirks dm_mirror dm_region_hash dm_log dm_mod [ 251.166014] CPU: 0 PID: 13380 Comm: tcmu-runner Kdump: loaded Not tainted 3.10.0-916.el7.test.x86_64 #1 [ 251.166381] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [ 251.166747] task: ffff971eb91db0c0 ti: ffff971e9e384000 task.ti: ffff971e9e384000 [ 251.167137] RIP: 0010:[<ffffffffc0736213>] [<ffffffffc0736213>] show_name+0x23/0x40 [uio] [ 251.167563] RSP: 0018:ffff971e9e387dc8 EFLAGS: 00010282 [ 251.167978] RAX: 0000000000000000 RBX: ffff971e9e3f8000 RCX: ffff971eb8368d98 [ 251.168408] RDX: ffff971e9e3f8000 RSI: ffffffffc0738084 RDI: ffff971e9e3f8000 [ 251.168856] RBP: ffff971e9e387dd0 R08: ffff971eb8bc0018 R09: 0000000000000000 [ 251.169296] R10: 0000000000001000 R11: ffffffffa09d444d R12: ffffffffa1076e80 [ 251.169750] R13: ffff971e9e387f18 R14: 0000000000000001 R15: ffff971e9cfb1c80 [ 251.170213] FS: 00007ff37d175880(0000) GS:ffff971ebb600000(0000) knlGS:0000000000000000 [ 251.170693] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 251.171248] CR2: 0000000000000008 CR3: 00000000001f6000 CR4: 00000000003607f0 [ 251.172071] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 251.172640] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 251.173236] Call Trace: [ 251.173789] [<ffffffffa0c9b2d3>] dev_attr_show+0x23/0x60 [ 251.174356] [<ffffffffa0f561b2>] ? mutex_lock+0x12/0x2f [ 251.174892] [<ffffffffa0ac6d9f>] sysfs_kf_seq_show+0xcf/0x1f0 [ 251.175433] [<ffffffffa0ac54e6>] kernfs_seq_show+0x26/0x30 [ 251.175981] [<ffffffffa0a63be0>] seq_read+0x110/0x3f0 [ 251.176609] [<ffffffffa0ac5d45>] kernfs_fop_read+0xf5/0x160 [ 251.177158] [<ffffffffa0a3d3af>] vfs_read+0x9f/0x170 [ 251.177707] [<ffffffffa0a3e27f>] SyS_read+0x7f/0xf0 [ 251.178268] [<ffffffffa0f648af>] system_call_fastpath+0x1c/0x21 [ 251.178823] Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 53 48 89 d3 e8 7e 96 56 e0 48 8b 80 d8 02 00 00 48 89 df 48 c7 c6 84 80 73 c0 <48> 8b 50 08 31 c0 e8 e2 67 44 e0 5b 48 98 5d c3 0f 1f 00 66 2e [ 251.180115] RIP [<ffffffffc0736213>] show_name+0x23/0x40 [uio] [ 251.180820] RSP <ffff971e9e387dc8> [ 251.181473] CR2: 0000000000000008 CC: Hamish Martin <hamish.martin@alliedtelesis.co.nz> CC: Mike Christie <mchristi@redhat.com> Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz> Signed-off-by: Xiubo Li <xiubli@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 543af58 commit 57c5f4d

File tree

1 file changed

+88
-16
lines changed

1 file changed

+88
-16
lines changed

‎drivers/uio/uio.c‎

Lines changed: 88 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -215,15 +215,41 @@ static ssize_t name_show(struct device *dev,
215215
struct device_attribute *attr, char *buf)
216216
{
217217
struct uio_device *idev = dev_get_drvdata(dev);
218-
return sprintf(buf, "%s\n", idev->info->name);
218+
int ret;
219+
220+
mutex_lock(&idev->info_lock);
221+
if (!idev->info) {
222+
ret = -EINVAL;
223+
dev_err(dev, "the device has been unregistered\n");
224+
goto out;
225+
}
226+
227+
ret = sprintf(buf, "%s\n", idev->info->name);
228+
229+
out:
230+
mutex_unlock(&idev->info_lock);
231+
return ret;
219232
}
220233
static DEVICE_ATTR_RO(name);
221234

222235
static ssize_t version_show(struct device *dev,
223236
struct device_attribute *attr, char *buf)
224237
{
225238
struct uio_device *idev = dev_get_drvdata(dev);
226-
return sprintf(buf, "%s\n", idev->info->version);
239+
int ret;
240+
241+
mutex_lock(&idev->info_lock);
242+
if (!idev->info) {
243+
ret = -EINVAL;
244+
dev_err(dev, "the device has been unregistered\n");
245+
goto out;
246+
}
247+
248+
ret = sprintf(buf, "%s\n", idev->info->version);
249+
250+
out:
251+
mutex_unlock(&idev->info_lock);
252+
return ret;
227253
}
228254
static DEVICE_ATTR_RO(version);
229255

@@ -415,11 +441,15 @@ EXPORT_SYMBOL_GPL(uio_event_notify);
415441
static irqreturn_t uio_interrupt(int irq, void *dev_id)
416442
{
417443
struct uio_device *idev = (struct uio_device *)dev_id;
418-
irqreturn_t ret = idev->info->handler(irq, idev->info);
444+
irqreturn_t ret;
445+
446+
mutex_lock(&idev->info_lock);
419447

448+
ret = idev->info->handler(irq, idev->info);
420449
if (ret == IRQ_HANDLED)
421450
uio_event_notify(idev->info);
422451

452+
mutex_unlock(&idev->info_lock);
423453
return ret;
424454
}
425455

@@ -460,6 +490,12 @@ static int uio_open(struct inode *inode, struct file *filep)
460490
filep->private_data = listener;
461491

462492
mutex_lock(&idev->info_lock);
493+
if (!idev->info) {
494+
mutex_unlock(&idev->info_lock);
495+
ret = -EINVAL;
496+
goto err_alloc_listener;
497+
}
498+
463499
if (idev->info && idev->info->open)
464500
ret = idev->info->open(idev->info, inode);
465501
mutex_unlock(&idev->info_lock);
@@ -590,6 +626,11 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
590626
s32 irq_on;
591627

592628
mutex_lock(&idev->info_lock);
629+
if (!idev->info) {
630+
retval = -EINVAL;
631+
goto out;
632+
}
633+
593634
if (!idev->info || !idev->info->irq) {
594635
retval = -EIO;
595636
goto out;
@@ -635,10 +676,20 @@ static vm_fault_t uio_vma_fault(struct vm_fault *vmf)
635676
struct page *page;
636677
unsigned long offset;
637678
void *addr;
679+
int ret = 0;
680+
int mi;
638681

639-
int mi = uio_find_mem_index(vmf->vma);
640-
if (mi < 0)
641-
return VM_FAULT_SIGBUS;
682+
mutex_lock(&idev->info_lock);
683+
if (!idev->info) {
684+
ret = VM_FAULT_SIGBUS;
685+
goto out;
686+
}
687+
688+
mi = uio_find_mem_index(vmf->vma);
689+
if (mi < 0) {
690+
ret = VM_FAULT_SIGBUS;
691+
goto out;
692+
}
642693

643694
/*
644695
* We need to subtract mi because userspace uses offset = N*PAGE_SIZE
@@ -653,7 +704,11 @@ static vm_fault_t uio_vma_fault(struct vm_fault *vmf)
653704
page = vmalloc_to_page(addr);
654705
get_page(page);
655706
vmf->page = page;
656-
return 0;
707+
708+
out:
709+
mutex_unlock(&idev->info_lock);
710+
711+
return ret;
657712
}
658713

659714
static const struct vm_operations_struct uio_logical_vm_ops = {
@@ -678,6 +733,7 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
678733
struct uio_device *idev = vma->vm_private_data;
679734
int mi = uio_find_mem_index(vma);
680735
struct uio_mem *mem;
736+
681737
if (mi < 0)
682738
return -EINVAL;
683739
mem = idev->info->mem + mi;
@@ -719,30 +775,46 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma)
719775

720776
vma->vm_private_data = idev;
721777

778+
mutex_lock(&idev->info_lock);
779+
if (!idev->info) {
780+
ret = -EINVAL;
781+
goto out;
782+
}
783+
722784
mi = uio_find_mem_index(vma);
723-
if (mi < 0)
724-
return -EINVAL;
785+
if (mi < 0) {
786+
ret = -EINVAL;
787+
goto out;
788+
}
725789

726790
requested_pages = vma_pages(vma);
727791
actual_pages = ((idev->info->mem[mi].addr & ~PAGE_MASK)
728792
+ idev->info->mem[mi].size + PAGE_SIZE -1) >> PAGE_SHIFT;
729-
if (requested_pages > actual_pages)
730-
return -EINVAL;
793+
if (requested_pages > actual_pages) {
794+
ret = -EINVAL;
795+
goto out;
796+
}
731797

732798
if (idev->info->mmap) {
733799
ret = idev->info->mmap(idev->info, vma);
734-
return ret;
800+
goto out;
735801
}
736802

737803
switch (idev->info->mem[mi].memtype) {
738804
case UIO_MEM_PHYS:
739-
return uio_mmap_physical(vma);
805+
ret = uio_mmap_physical(vma);
806+
break;
740807
case UIO_MEM_LOGICAL:
741808
case UIO_MEM_VIRTUAL:
742-
return uio_mmap_logical(vma);
809+
ret = uio_mmap_logical(vma);
810+
break;
743811
default:
744-
return -EINVAL;
812+
ret = -EINVAL;
745813
}
814+
815+
out:
816+
mutex_unlock(&idev->info_lock);
817+
return 0;
746818
}
747819

748820
static const struct file_operations uio_fops = {
@@ -932,12 +1004,12 @@ void uio_unregister_device(struct uio_info *info)
9321004

9331005
uio_free_minor(idev);
9341006

1007+
mutex_lock(&idev->info_lock);
9351008
uio_dev_del_attributes(idev);
9361009

9371010
if (info->irq && info->irq != UIO_IRQ_CUSTOM)
9381011
free_irq(info->irq, idev);
9391012

940-
mutex_lock(&idev->info_lock);
9411013
idev->info = NULL;
9421014
mutex_unlock(&idev->info_lock);
9431015

0 commit comments

Comments
 (0)