Revision 647e82dbf85124697be59a4b4cf00c0d38177dcb authored by Andy Shevchenko on 01 September 2022, 11:34:06 UTC, committed by Hans de Goede on 01 September 2022, 15:51:34 UTC
We have to copy only selected fields from the original resource. Because a PCI device will be removed immediately after getting its resources, we may not use any allocated data, hence we may not copy any pointers. Consider the following scenario: 1/ a caller of p2sb_bar() gets the resource; 2/ the resource has been copied by platform_device_add_data() in order to create a platform device; 3/ the platform device creation will call for the device driver's ->probe() as soon as a match found; 4/ the ->probe() takes given resources (see 2/) and tries to access one of its field, i.e. 'name', in the __devm_ioremap_resource() to create a pretty looking output; 5/ but the 'name' is a dangling pointer because p2sb_bar() removed a PCI device, which 'name' had been copied to the caller's memory. 6/ UAF (Use-After-Free) as a result. Kudos to Mika for the initial analisys of the issue. Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support") Reported-by: kernel test robot <oliver.sang@intel.com> Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com> Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/ Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/ Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
1 parent 5542dfc
File | Mode | Size |
---|---|---|
cxgbit | ||
Kconfig | -rw-r--r-- | 338 bytes |
Makefile | -rw-r--r-- | 648 bytes |
iscsi_target.c | -rw-r--r-- | 130.0 KB |
iscsi_target.h | -rw-r--r-- | 2.5 KB |
iscsi_target_auth.c | -rw-r--r-- | 13.9 KB |
iscsi_target_auth.h | -rw-r--r-- | 1.3 KB |
iscsi_target_configfs.c | -rw-r--r-- | 45.0 KB |
iscsi_target_datain_values.c | -rw-r--r-- | 13.8 KB |
iscsi_target_datain_values.h | -rw-r--r-- | 683 bytes |
iscsi_target_device.c | -rw-r--r-- | 1.7 KB |
iscsi_target_device.h | -rw-r--r-- | 328 bytes |
iscsi_target_erl0.c | -rw-r--r-- | 26.0 KB |
iscsi_target_erl0.h | -rw-r--r-- | 951 bytes |
iscsi_target_erl1.c | -rw-r--r-- | 31.4 KB |
iscsi_target_erl1.h | -rw-r--r-- | 1.7 KB |
iscsi_target_erl2.c | -rw-r--r-- | 11.7 KB |
iscsi_target_erl2.h | -rw-r--r-- | 1.1 KB |
iscsi_target_login.c | -rw-r--r-- | 39.3 KB |
iscsi_target_login.h | -rw-r--r-- | 1.2 KB |
iscsi_target_nego.c | -rw-r--r-- | 36.6 KB |
iscsi_target_nego.h | -rw-r--r-- | 909 bytes |
iscsi_target_nodeattrib.c | -rw-r--r-- | 7.1 KB |
iscsi_target_nodeattrib.h | -rw-r--r-- | 913 bytes |
iscsi_target_parameters.c | -rw-r--r-- | 45.9 KB |
iscsi_target_parameters.h | -rw-r--r-- | 9.8 KB |
iscsi_target_seq_pdu_list.c | -rw-r--r-- | 16.9 KB |
iscsi_target_seq_pdu_list.h | -rw-r--r-- | 2.2 KB |
iscsi_target_stat.c | -rw-r--r-- | 22.7 KB |
iscsi_target_tmr.c | -rw-r--r-- | 23.1 KB |
iscsi_target_tmr.h | -rw-r--r-- | 747 bytes |
iscsi_target_tpg.c | -rw-r--r-- | 22.3 KB |
iscsi_target_tpg.h | -rw-r--r-- | 2.8 KB |
iscsi_target_transport.c | -rw-r--r-- | 1.2 KB |
iscsi_target_util.c | -rw-r--r-- | 34.1 KB |
iscsi_target_util.h | -rw-r--r-- | 4.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...