Bug 255865 - [PATCH] dev/ocs_fc: Fix uaf & double free bugs in ocs_hw_async_call
Summary: [PATCH] dev/ocs_fc: Fix uaf & double free bugs in ocs_hw_async_call
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: Ram Kishore Vegesna
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-14 10:47 UTC by lylgood
Modified: 2021-05-28 06:15 UTC (History)
2 users (show)

See Also:


Attachments
returns error message if sli_cmd_common_nop() failed (472 bytes, patch)
2021-05-14 10:47 UTC, lylgood
no flags Details | Diff
return OCS_HW_RTN_ERROR during failure. (979 bytes, text/plain)
2021-05-27 06:08 UTC, Ram Kishore Vegesna
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description lylgood 2021-05-14 10:47:40 UTC
Created attachment 224929 [details]
returns error message if sli_cmd_common_nop() failed

Bug File: sys/dev/ocs_fc/ocs_hw.c

In function ocs_hw_async_call, if sli_cmd_common_nop() failed, ctx will be freed via ocs_free() at line 11,800. But the freed ctx is used in the later callee ocs_hw_command(.., ctx->cmd, ..., ctx), which is a use after free bug.

If the later callee ocs_hw_command() failed, the freed ctx is freed again via 
ocs_free() at line 11,806, which is a double free bug.

My patch returns the error message if sli_cmd_common_nop() failed, to avoid the later uaf and double free bugs.
Comment 1 Ram Kishore Vegesna freebsd_committer 2021-05-27 06:08:07 UTC
Created attachment 225301 [details]
return OCS_HW_RTN_ERROR during failure.
Comment 2 Ram Kishore Vegesna freebsd_committer 2021-05-27 06:11:09 UTC
Thanks for reporting the issue. Made some changes to your patch to directly return failure. 

Please let me know if you want me to check-in these changes.
Comment 3 lylgood 2021-05-27 07:52:15 UTC
(In reply to Ram Kishore Vegesna from comment #2)
Ok, thanks.
Comment 4 commit-hook freebsd_committer 2021-05-28 06:05:36 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=7377d3831bc8abec2d6e5fee359d7383d4551feb

commit 7377d3831bc8abec2d6e5fee359d7383d4551feb
Author:     Ram Kishore Vegesna <ram@FreeBSD.org>
AuthorDate: 2021-05-28 05:51:10 +0000
Commit:     Ram Kishore Vegesna <ram@FreeBSD.org>
CommitDate: 2021-05-28 05:51:10 +0000

    ocs_fc: Fix use after free bug in ocs_hw_async_call()

    Freed ctx is used in the later callee ocs_hw_command(),
    which is a use after free bug.

    Return error if sli_cmd_common_nop() failed.

    PR: 255865
    Reported by: lylgood@foxmail.com
    Approved by:: markj

 sys/dev/ocs_fc/ocs_hw.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)