Ming Lei 875979368e firmware loader: fix use-after-free by double abort ...

fw_priv->buf is accessed in both request_firmware_load() and
writing to sysfs file of 'loading' context, but not protected
by 'fw_lock' entirely. The patch makes sure that access on
'fw_priv->buf' is protected by the lock.

So fixes the double abort problem reported by nirinA raseliarison:

	http://lkml.org/lkml/2013/6/14/188

Reported-and-tested-by: nirinA raseliarison <nirina.raseliarison@gmail.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable <stable@vger.kernel.org> # 3.9
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2013-06-18 10:41:55 -07:00

..

power

PM: Avoid calling kfree() under spinlock in dev_pm_put_subsys_data()

2013-05-12 14:04:40 +02:00

regmap

Merge remote-tracking branch 'regmap/fix/debugfs' into regmap-linus

2013-06-03 18:07:38 +01:00

attribute_container.c

drivers: base: Convert dev_printk(KERN_<LEVEL> to dev_<level>(

2012-10-30 17:38:43 -07:00

base.h

driver/base: implement subsys_virtual_register()

2013-03-12 11:36:35 -07:00

bus.c

driver core: export subsys_virtual_register

2013-05-21 09:05:52 -07:00

class.c

driver-core: constify data for class_find_device()

2013-02-06 12:18:56 -08:00

core.c

driver core: print sysfs attribute name when warning about bogus permissions

2013-05-21 09:05:52 -07:00

cpu.c

numa, cpu hotplug: change links of CPU and node when changing node number by onlining CPU

2013-04-29 15:54:39 -07:00

dd.c

PM / Runtime: Idle devices asynchronously after probe|release

2013-04-11 12:42:52 -07:00

devres.c

Linux 3.9-rc3

2013-03-17 19:40:50 -07:00

devtmpfs.c

driver core: handle user namespaces properly with the uid/gid devtmpfs change

2013-04-11 11:43:29 -07:00

dma-buf.c

dma-buf: Add debugfs support

2013-05-01 16:36:22 +05:30

dma-coherent.c

drivers: dma-coherent: Fix typo in dma_mmap_from_coherent documentation

2012-10-23 14:05:32 +02:00

dma-contiguous.c

drivers: cma: represent physical addresses as phys_addr_t

2012-12-11 09:28:09 +01:00

dma-mapping.c

[media] dma-mapping: fix dma_common_get_sgtable() conditional compilation

2012-11-27 09:42:31 -02:00

driver.c

driver core: don't trigger uevent after failure

2012-07-17 10:40:23 -07:00

firmware_class.c

firmware loader: fix use-after-free by double abort

2013-06-18 10:41:55 -07:00

firmware.c

firmware: change firmware_kset to firmware_kobj

2008-01-24 20:40:23 -08:00

hypervisor.c

drivers/base: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required.

2011-10-31 19:31:38 -04:00

init.c

driver-core: implement 'sysdev' functionality for regular devices and buses

2011-12-14 14:29:38 -08:00

isa.c

dma-mapping: replace all DMA_24BIT_MASK macro with DMA_BIT_MASK(24)

2009-04-07 08:31:12 -07:00

Kconfig

firmware: Make user-mode helper optional

2013-02-03 17:57:40 -08:00

Makefile

drivers/pinctrl: grab default handles from device core

2013-01-23 16:39:51 +01:00

map.c

[PATCH] kobj_map semaphore to mutex conversion

2006-03-20 13:42:58 -08:00

memory.c

mm: Remove unused parameter of pages_correctly_reserved()

2013-04-29 15:54:38 -07:00

module.c

driver core: module.c: Use kasprintf

2010-05-21 09:37:29 -07:00

node.c

drivers/base/node.c: switch to register_hotmemory_notifier()

2013-04-29 15:54:36 -07:00

pinctrl.c

drivers/pinctrl: grab default handles from device core

2013-01-23 16:39:51 +01:00

platform.c

driver core: platform.c: fix checkpatch errors and warnings

2013-03-29 09:10:55 -07:00

soc.c

mode_t whack-a-mole: ->is_visible() returns umode_t...

2012-05-29 23:28:42 -04:00

syscore.c

PM: Reintroduce dropped call to check_wakeup_irqs

2011-07-11 10:51:49 +02:00

topology.c

cpu: convert 'cpu' and 'machinecheck' sysdev_class to a regular subsystem

2011-12-21 14:29:42 -08:00

transport_class.c

drivers/base: transport_class explicitly requires EXPORT_SYMBOL

2011-10-31 19:31:15 -04:00