Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us with none. Calling dma_buf_put() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free. Simply avoid calling dma_buf_put() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6cffd79504ce040f460831030d3069fa1c99bb71 to < 4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215affected6cffd79504ce040f460831030d3069fa1c99bb71 to < a5ce7ee5fcc07583159f54ab4af5164de00148f5affected6cffd79504ce040f460831030d3069fa1c99bb71 to < e4382d0a39f9a1e260d62fdc079ddae5293c037daffected6cffd79504ce040f460831030d3069fa1c99bb71 to < 76f85c307ef9f10aa2cef1b1d5ee654c1f3345fcaffected6cffd79504ce040f460831030d3069fa1c99bb71 to < 46963e2e0629cb31c96b1d47ddd89dc3d8990b34affected
Linux Linux
Default version status: affected
5.1affected0 to < 5.1unaffected5.4.180 to ≤ 5.4.*unaffected5.10.101 to ≤ 5.10.*unaffected5.15.24 to ≤ 5.15.*unaffected5.16.10 to ≤ 5.16.*unaffected5.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215 ↗
- https://git.kernel.org/stable/c/a5ce7ee5fcc07583159f54ab4af5164de00148f5 ↗
- https://git.kernel.org/stable/c/e4382d0a39f9a1e260d62fdc079ddae5293c037d ↗
- https://git.kernel.org/stable/c/76f85c307ef9f10aa2cef1b1d5ee654c1f3345fc ↗
- https://git.kernel.org/stable/c/46963e2e0629cb31c96b1d47ddd89dc3d8990b34 ↗