• Ben Wolsieffer's avatar
    staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION · 5a96b2d3
    Ben Wolsieffer authored
    The compatibility ioctl wrapper for VCHIQ_IOC_AWAIT_COMPLETION assumes that
    the native ioctl always uses a message buffer and decrements msgbufcount.
    Certain message types do not use a message buffer and in this case
    msgbufcount is not decremented, and completion->header for the message is
    NULL. Because the wrapper unconditionally decrements msgbufcount, the
    calling process may assume that a message buffer has been used even when
    it has not.
    This results in a memory leak in the userspace code that interfaces with
    this driver. When msgbufcount is decremented, the userspace code assumes
    that the buffer can be freed though the reference in completion->header,
    which cannot happen when the reference is NULL.
    This patch causes the wrapper to only decrement msgbufcount when the
    native ioctl decrements it. Note that we cannot simply copy the native
    ioctl's value of msgbufcount, because the wrapper only retrieves messages
    from the native ioctl one at a time, while userspace may request multiple
    See https://github.com/raspberrypi/linux/pull/2703 for more discussion of
    this patch.
    Fixes: 5569a126 ("staging: vchiq_arm: Add compatibility wrappers for ioctls")
    Signed-off-by: Ben Wolsieffer's avatarBen Wolsieffer <benwolsieffer@gmail.com>
    Acked-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
vchiq_arm.c 96.7 KB