github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: ccp - fix SFS ioctl race against device teardown

Browse Source 
sfs_ioctl() reads psp_master->sfs_data and caches it in sfs_dev before
taking sfs_ioctl_mutex, while sfs_dev_destroy() frees sfs_dev->page
and sfs_dev->command_buf with no locking at all and only clears
psp->sfs_data afterwards. A call to sfs_ioctl() that reads sfs_data
just before sfs_dev_destroy() runs will still acquire the mutex and
go on to use the now-freed command buffer in send_sfs_cmd().

Have both functions take sfs_ioctl_mutex before touching
psp->sfs_data, so a call that is already using sfs_dev completes
before teardown can free it, and a call arriving after teardown sees
sfs_data cleared and returns -ENODEV instead of racing it.

Fixes: 648dbccc03 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Muhammad Bilal 2026-09-20 00:24:32 +05:00 committed by Herbert Xu
parent 5d504e6551
commit de4929b476
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/crypto/ccp/sfs.c
View File

@ -111,13 +111,13 @@ static long sfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
struct sfs_device *sfs_dev;
int ret = 0;
guard(mutex)(&sfs_ioctl_mutex);
if (!psp_master || !psp_master->sfs_data)
return -ENODEV;
sfs_dev = psp_master->sfs_data;
guard(mutex)(&sfs_ioctl_mutex);
switch (cmd) {
case SFSIOCFWVERS:
dev_dbg(sfs_dev->dev, "in SFSIOCFWVERS\n");
@ -191,8 +191,11 @@ static void sfs_exit(struct kref *ref)
void sfs_dev_destroy(struct psp_device *psp)
{
struct sfs_device *sfs_dev = psp->sfs_data;
struct sfs_device *sfs_dev;
guard(mutex)(&sfs_ioctl_mutex);
sfs_dev = psp->sfs_data;
if (!sfs_dev)
return;