iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d5a5e5b5fa
linux/drivers/input/rmi4
History
Evan Green d5a5e5b5fa Input: synaptics-rmi4 - really fix attn_data use-after-free 
Fix a use-after-free noticed by running with KASAN enabled. If
rmi_irq_fn() is run twice in a row, then rmi_f11_attention() (among
others) will end up reading from drvdata->attn_data.data, which was
freed and left dangling in rmi_irq_fn().

Commit 55edde9fff ("Input: synaptics-rmi4 - prevent UAF reported by
KASAN") correctly identified and analyzed this bug. However the attempted
fix only NULLed out a local variable, missing the fact that
drvdata->attn_data is a struct, not a pointer.

NULL out the correct pointer in the driver data to prevent the attention
functions from copying from it.

Fixes: 55edde9fff ("Input: synaptics-rmi4 - prevent UAF reported by KASAN")
Fixes: b908d3cd81 ("Input: synaptics-rmi4 - allow to add attention data")
Signed-off-by: Evan Green <evgreen@chromium.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200427145537.1.Ic8f898e0147beeee2c005ee7b20f1aebdef1e7eb@changeid
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2020-04-27 18:13:37 -07:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rmi_2d_sensor.c Input: synaptics-rmi4 - remove the exporting of rmi_2d_sensor_set_input_params 2019-07-24 12:58:11 +03:00
rmi_2d_sensor.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_bus.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_bus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_driver.c Input: synaptics-rmi4 - really fix attn_data use-after-free 2020-04-27 18:13:37 -07:00
rmi_driver.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_f01.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_f03.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_f11.c Input: synaptics-rmi4 - set reduced reporting mode only when requested 2020-03-24 15:45:18 -07:00
rmi_f12.c Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) 2019-11-04 16:11:50 -08:00
rmi_f30.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_f34.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_f34.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_f34v7.c Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash 2019-12-04 17:58:16 -08:00
rmi_f54.c Input: rmi_f54 - read from FIFO in 32 byte blocks 2020-01-16 20:22:56 -08:00
rmi_f55.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rmi_smbus.c Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers" 2020-01-16 20:22:55 -08:00
rmi_spi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00