Page MenuHomeFreeBSD

firewire: Fix watchdog_clock aliasing and fw_tl2xfer UAF race
ClosedPublic

Authored by guest-seuros on Sun, Jun 7, 2:47 PM.
Referenced Files
Unknown Object (File)
Mon, Jun 8, 1:52 AM
Unknown Object (File)
Sun, Jun 7, 11:06 PM
Subscribers

Details

Summary

Two bugs in the firewire bus layer that affect all consumers (
if_fwip, sbp):

watchdog_clock was a static local in firewire_watchdog(), shared across
all firewire_comm instances. With two controllers (e.g. built-in +
Thunderbolt Display), both advance the same counter, so the second
controller's 15-second boot-time timeout guard expires prematurely.

fw_tl2xfer() released tlabel_lock before returning the xfer pointer.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

sys/dev/firewire/firewire.c
1057

oh god, why are there still spl calls in here?

Are they even needed anymore?

guest-seuros added inline comments.
sys/dev/firewire/firewire.c
1057

Not used.

This broadly looks good to me but I am currently unable to test it.

This revision is now accepted and ready to land.Mon, Jun 8, 4:34 AM

The part watchdog_clock of this change looks good to me.

I know little about AT transmit so I can not speak about it.

sys/dev/firewire/firewire.c
386

Only on callout soft thread is running this, so no lock for firewire_watchdog appears good.

zlei retitled this revision from fix(firewire): fix watchdog_clock aliasing and fw_tl2xfer UAF race to firewire: Fix watchdog_clock aliasing and fw_tl2xfer UAF race.Mon, Jun 8, 7:37 AM