[PATCH] platform/raspberrypi: Fix service use-after-free in vchiq_blocking_bulk_transfer()

[Wentao Liang]

find_service_by_handle() returns the service with a reference taken,
but vchiq_blocking_bulk_transfer() drops it immediately and then keeps
dereferencing service->state to reach the bulk_waiter spinlock on the
"not a retry" and "cancel the signal" paths.  Once a concurrent
vchiq_free_service_internal() releases the last reference the service
is freed, so those accesses use freed memory.

Hold the reference until the end of the function instead, as
vchiq_service_callback() already does.

Fixes: 12cc5f92c159 ("staging: vc04_services: Move spinlocks to vchiq_state")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/platform/raspberrypi/vchiq-interface/vchiq_arm.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/raspberrypi/vchiq-interface/vchiq_arm.c b/drivers/platform/raspberrypi/vchiq-interface/vchiq_arm.c
index e78641703252..10f33a04e22a 100644
--- a/drivers/platform/raspberrypi/vchiq-interface/vchiq_arm.c
+++ b/drivers/platform/raspberrypi/vchiq-interface/vchiq_arm.c
@@ -588,8 +588,6 @@ vchiq_blocking_bulk_transfer(struct vchiq_instance *instance, unsigned int handl
 	if (!service)
 		return -EINVAL;
 
-	vchiq_service_put(service);
-
 	mutex_lock(&instance->bulk_waiter_list_mutex);
 	list_for_each_entry(iter, &instance->bulk_waiter_list, list) {
 		if (iter->pid == current->pid) {
@@ -619,8 +617,10 @@ vchiq_blocking_bulk_transfer(struct vchiq_instance *instance, unsigned int handl
 		}
 	} else {
 		waiter = kzalloc_obj(*waiter);
-		if (!waiter)
+		if (!waiter) {
+			vchiq_service_put(service);
 			return -ENOMEM;
+		}
 	}
 
 	bulk_params->waiter = &waiter->bulk_waiter;
@@ -645,6 +645,8 @@ vchiq_blocking_bulk_transfer(struct vchiq_instance *instance, unsigned int handl
 			waiter, current->pid);
 	}
 
+	vchiq_service_put(service);
+
 	return ret;
 }
 
-- 
2.34.1