iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8b40c38e37
linux/drivers/base
History
Russ Weight 8b40c38e37 firmware_loader: Fix use-after-free during unregister 
In the following code within firmware_upload_unregister(), the call to
device_unregister() could result in the dev_release function freeing the
fw_upload_priv structure before it is dereferenced for the call to
module_put(). This bug was found by the kernel test robot using
CONFIG_KASAN while running the firmware selftests.

  device_unregister(&fw_sysfs->dev);
  module_put(fw_upload_priv->module);

The problem is fixed by copying fw_upload_priv->module to a local variable
for use when calling device_unregister().

Fixes: 97730bbb24 ("firmware_loader: Add firmware-upload support")
Cc: stable <stable@kernel.org>
Reported-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Link: https://lore.kernel.org/r/20220829174557.437047-1-russell.h.weight@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-01 17:46:54 +02:00
..
firmware_loader firmware_loader: Fix use-after-free during unregister 2022-09-01 17:46:54 +02:00
power Revert "PM: domains: Delete usage of driver_deferred_probe_check_state()" 2022-08-23 13:14:02 +02:00
regmap regmap: permit to set reg_update_bits with bulk implementation 2022-07-18 13:45:28 +01:00
test driver core: Simplify async probe test code by using ktime_ms_delta() 2021-12-29 10:57:22 +01:00
arch_numa.c mm: percpu: add generic pcpu_populate_pte() function 2022-01-20 08:52:52 +02:00
arch_topology.c arch_topology: Silence early cacheinfo errors when non-existent 2022-09-01 16:31:09 +02:00
attribute_container.c driver core: attribute_container: fix W=1 warnings 2021-05-14 13:37:10 +02:00
auxiliary.c Documentation/auxiliary_bus: Move the text into the code 2021-12-03 16:41:50 +01:00
base.h driver core: Add wait_for_init_devices_probe helper function 2022-06-10 15:57:54 +02:00
bus.c driver: base: fix UAF when driver_attach failed 2022-05-19 19:28:42 +02:00
cacheinfo.c cacheinfo: Use atomic allocation for percpu cache attributes 2022-07-22 10:04:42 +02:00
class.c block: remove genhd.h 2022-02-02 07:49:59 -07:00
component.c component: Add common helper for compare/release functions 2022-02-25 12:16:12 +01:00
container.c
core.c Driver core / kernfs changes for 6.0-rc1 2022-08-04 11:31:20 -07:00
cpu.c x86/bugs: Report AMD retbleed vulnerability 2022-06-27 10:33:59 +02:00
dd.c driver core: Don't probe devices after bus_type.match() probe deferral 2022-09-01 15:57:13 +02:00
devcoredump.c Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" 2022-06-27 16:39:29 +02:00
devres.c devres: fix typos in comments 2022-03-18 14:30:12 +01:00
devtmpfs.c devtmpfs: fix the dangling pointer of global devtmpfsd thread 2022-06-27 16:41:13 +02:00
driver.c driver core: Extend deferred probe timeout on driver registration 2022-05-19 19:32:33 +02:00
firmware.c
hypervisor.c
init.c init: Initialize noop_backing_dev_info early 2022-06-16 10:55:57 +02:00
isa.c bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
Kconfig devtmpfs: mount with noexec and nosuid 2021-12-30 13:54:42 +01:00
Makefile driver core: Add sysfs support for physical location of a device 2022-04-27 09:51:57 +02:00
map.c driver: base: Prefer unsigned int to bare use of unsigned 2021-07-21 17:30:09 +02:00
memory.c mm/memory-failure: disable unpoison once hw error happens 2022-06-16 19:11:32 -07:00
module.c
node.c drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist 2022-07-15 17:36:33 +02:00
physical_location.c driver core: location: Add "back" as a possible output for panel 2022-05-19 19:28:32 +02:00
physical_location.h driver core: Add sysfs support for physical location of a device 2022-04-27 09:51:57 +02:00
pinctrl.c
platform-msi.c platform-msi: Simplify platform device MSI code 2021-12-16 22:22:19 +01:00
platform.c Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
property.c USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
soc.c base: soc: Make soc_device_match() simpler and easier to read 2022-03-18 14:28:07 +01:00
swnode.c software node: fix wrong node passed to find nargs_prop 2021-12-22 18:26:18 +01:00
syscore.c
topology.c drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist 2022-07-15 17:36:33 +02:00
trace.c devres: Enable trace events 2021-06-15 17:14:36 +02:00
trace.h devres: Enable trace events 2021-06-15 17:14:36 +02:00
transport_class.c