CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver

[马哲宇 <zheyuma97 () gmail com>]

Hello,

I found a bug in the latest Linux kernel. The
location of the bug is Linux/drivers/firewire/nosy.c.   Nosy is an
IEEE 1394 packet sniffer which is used for protocol analysis and in the
development of IEEE 1394 drivers, applications, or firmware.

For each device, the nosy driver allocates a pcilynx structure. A
use-after-free might happen in the following scenario:

1. Open nosy device for the first time and call ioctl with command
NOSY_IOC_START, then a new client A will be malloced and added to
doubly linked list.
2. Open nosy device for the second time and call ioctl with command
NOSY_IOC_START, then a new client B will be malloced and added to
doubly linked list.
3. Call ioctl with command NOSY_IOC_START for client A, then client A
will be readded to the doubly linked list. Now the doubly linked list
is messed up.
4. Close the first nosy device and nosy_release will be called. In
nosy_release, client A will be unlinked and freed.
5. Close the second nosy device, and client A will be referenced,
resulting in UAF.

The root cause of this bug is that the element in the doubly linked
list is reentered into the list.

Here is the commit to patch this BUG:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=829933ef05a951c8ff140e814656d73e74915faf

Regards,

Zheyu Ma