counter: Fix use-after-free race condition for events_queue_size write
authorWilliam Breathitt Gray <vilhelm.gray@gmail.com>
Thu, 21 Oct 2021 10:35:40 +0000 (19:35 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 21 Oct 2021 11:02:47 +0000 (13:02 +0200)
commit8ac33b8b6841e99a624ace543d92cbf598a91381
treebfbb42f1f6f41bc9fb8cae0098746d382196ad67
parent310e75c72fefa3b0b4535f669c8b37c963a2dba5
counter: Fix use-after-free race condition for events_queue_size write

A race condition is possible when writing to events_queue_size where the
events kfifo is freed during the execution of a kfifo_in(), resulting in
a use-after-free. This patch prevents such a scenario by protecting the
events queue in operation with a spinlock and locking before performing
the events queue size adjustment.

The existing events_lock mutex is renamed to events_out_lock to reflect
that it only protects events queue out operations. Because the events
queue in operations can occur in an interrupt context, a new
events_in_lock spinlock is introduced and utilized.

Fixes: feff17a550c7 ("counter: Implement events_queue_size sysfs attribute")
Cc: David Lechner <david@lechnology.com>
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Link: https://lore.kernel.org/r/20211021103540.955639-1-vilhelm.gray@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/counter/counter-chrdev.c
drivers/counter/counter-sysfs.c
include/linux/counter.h