ARM: amba: CVE-2018-9415

ARM: amba: Fix race condition with driver_override

References:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=272c99cf85a371401b78f3c56a18745bf07817a3

Change-Id: I9367a1d020bc4641f136a91d2ff29442221ee9e8
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 78 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index c97927f..9950d18 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -18,3 +18,4 @@ patch CVE-2018-1108-random-fix-crng_ready-test.patch
 
 #CVEs fixed in 4.9.98:
 patch CVE-2018-1093-ext4-add-validity-checks-for-bitmap-block-numbers.patch
+patch CVE-2018-9415-ARM-amba-Fix-race-condition-with-driver_override.patch
diff --git a/patches/cve/CVE-2018-9415-ARM-amba-Fix-race-condition-with-driver_override.patch b/patches/cve/CVE-2018-9415-ARM-amba-Fix-race-condition-with-driver_override.patch
new file mode 100644
index 0000000..363fb7b
--- /dev/null
+++ b/patches/cve/CVE-2018-9415-ARM-amba-Fix-race-condition-with-driver_override.patch
@@ -0,0 +1,77 @@
+Date: Fri, 12 Oct 2018 10:25:59 +0200
+Subject: [PATCH] ARM: amba: Fix race condition with driver_override commit
+ 6a7228d90d42bcacfe38786756ba62762b91c20a upstream.
+
+The driver_override implementation is susceptible to a race condition
+when different threads are reading vs storing a different driver
+override.  Add locking to avoid this race condition.
+
+Cfr. commits 6265539776a0810b ("driver core: platform: fix race
+condition with driver_override") and 9561475db680f714 ("PCI: Fix race
+condition with driver_override").
+
+Fixes: 3cf385713460eb2b ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'")
+
+CVE: CVE-2018-9415
+Upstream-Status: Backport
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ drivers/amba/bus.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index a56fa2a..b112448 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -69,11 +69,15 @@ static ssize_t driver_override_show(struct device *_dev,
+                                    struct device_attribute *attr, char *buf)
+ {
+        struct amba_device *dev = to_amba_device(_dev);
+-
++       ssize_t len;
++ 
+        if (!dev->driver_override)
+                return 0;
+ 
+-       return sprintf(buf, "%s\n", dev->driver_override);
++       device_lock(_dev);
++       len = sprintf(buf, "%s\n", dev->driver_override);
++       device_unlock(_dev);
++       return len;
+ }
+ 
+ static ssize_t driver_override_store(struct device *_dev,
+@@ -81,7 +85,7 @@ static ssize_t driver_override_store(struct device *_dev,
+                                     const char *buf, size_t count)
+ {
+        struct amba_device *dev = to_amba_device(_dev);
+-       char *driver_override, *old = dev->driver_override, *cp;
++       char *driver_override, *old, *cp;
+ 
+        if (count > PATH_MAX)
+                return -EINVAL;
+@@ -94,12 +98,15 @@ static ssize_t driver_override_store(struct device *_dev,
+        if (cp)
+                *cp = '\0';
+ 
++       device_lock(_dev);
++       old = dev->driver_override;
+        if (strlen(driver_override)) {
+                dev->driver_override = driver_override;
+        } else {
+               kfree(driver_override);
+               dev->driver_override = NULL;
+        }
++       device_unlock(_dev);
+ 
+        kfree(old);
+ 
+-- 
+
+