Revision - 8b40c38 - firmware_loader: Fix use-after-free during unregister - origin: https://github.com/torvalds/linux

visit type:

https://github.com/torvalds/linux

17 May 2024, 09:02:56 UTC

Revision 8b40c38e37492b5bdf8e95b46b5cca9517a9957a authored by Russ Weight on 29 August 2022, 17:45:57 UTC, committed by Greg Kroah-Hartman on 01 September 2022, 15:46:54 UTC

firmware_loader: Fix use-after-free during unregister

In the following code within firmware_upload_unregister(), the call to
device_unregister() could result in the dev_release function freeing the
fw_upload_priv structure before it is dereferenced for the call to
module_put(). This bug was found by the kernel test robot using
CONFIG_KASAN while running the firmware selftests.

  device_unregister(&fw_sysfs->dev);
  module_put(fw_upload_priv->module);

The problem is fixed by copying fw_upload_priv->module to a local variable
for use when calling device_unregister().

Fixes: 97730bbb242c ("firmware_loader: Add firmware-upload support")
Cc: stable <stable@kernel.org>
Reported-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Link: https://lore.kernel.org/r/20220829174557.437047-1-russell.h.weight@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 parent 9b03e79

Files
Changes

Permalinks

Tip revision: 8b40c38e37492b5bdf8e95b46b5cca9517a9957a authored by Russ Weight on 29 August 2022, 17:45:57 UTC
firmware_loader: Fix use-after-free during unregister

Tip revision: 8b40c38

File	Mode	Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
io_uring
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format	-rw-r--r--	19.9 KB
.cocciconfig	-rw-r--r--	59 bytes
.get_maintainer.ignore	-rw-r--r--	71 bytes
.gitattributes	-rw-r--r--	62 bytes
.gitignore	-rw-r--r--	1.9 KB
.mailmap	-rw-r--r--	23.5 KB
COPYING	-rw-r--r--	496 bytes
CREDITS	-rw-r--r--	99.1 KB
Kbuild	-rw-r--r--	1.3 KB
Kconfig	-rw-r--r--	555 bytes
MAINTAINERS	-rw-r--r--	663.5 KB
Makefile	-rw-r--r--	64.5 KB
README	-rw-r--r--	727 bytes

Showing with 0 additions and 0 deletions (0 / 0 diffs computed)

Computing file changes ...

https://github.com/torvalds/linux

firmware_loader: Fix use-after-free during unregister

README