https://github.com/torvalds/linux
Revision 22a1e7783e173ab3d86018eb590107d68df46c11 authored by Takashi Iwai on 17 November 2016, 09:49:31 UTC, committed by Mauro Carvalho Chehab on 23 November 2016, 23:04:26 UTC
The commit 8dfbcc4351a0 ("[media] xc2028: avoid use after free") tried to address the reported use-after-free by clearing the reference. However, it's clearing the wrong pointer; it sets NULL to priv->ctrl.fname, but it's anyway overwritten by the next line memcpy(&priv->ctrl, p, sizeof(priv->ctrl)). OTOH, the actual code accessing the freed string is the strcmp() call with priv->fname: if (!firmware_name[0] && p->fname && priv->fname && strcmp(p->fname, priv->fname)) free_firmware(priv); where priv->fname points to the previous file name, and this was already freed by kfree(). For fixing the bug properly, this patch does the following: - Keep the copy of firmware file name in only priv->fname, priv->ctrl.fname isn't changed; - The allocation is done only when the firmware gets loaded; - The kfree() is called in free_firmware() commonly Fixes: commit 8dfbcc4351a0 ('[media] xc2028: avoid use after free') Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
1 parent 9c76358
Tip revision: 22a1e7783e173ab3d86018eb590107d68df46c11 authored by Takashi Iwai on 17 November 2016, 09:49:31 UTC
xc2028: Fix use-after-free bug properly
xc2028: Fix use-after-free bug properly
Tip revision: 22a1e77
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
firmware | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.cocciconfig | -rw-r--r-- | 59 bytes |
.get_maintainer.ignore | -rw-r--r-- | 31 bytes |
.gitattributes | -rw-r--r-- | 30 bytes |
.gitignore | -rw-r--r-- | 1.3 KB |
.mailmap | -rw-r--r-- | 7.5 KB |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 96.0 KB |
Kbuild | -rw-r--r-- | 2.8 KB |
Kconfig | -rw-r--r-- | 252 bytes |
MAINTAINERS | -rw-r--r-- | 373.5 KB |
Makefile | -rw-r--r-- | 57.5 KB |
README | -rw-r--r-- | 17.9 KB |
REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
Computing file changes ...