Messages in this thread | | | Date | Fri, 9 Dec 2011 15:57:32 -0800 | From | Greg KH <> | Subject | Re: [PATCH 1/1] firmware_loading_store: fix firmware loading use-after-free oops |
| |
On Thu, Dec 01, 2011 at 05:26:10PM +0800, DONG-DONG YANG wrote: > > firmware_loading_store() should check for fw_priv->fw before fw_load_abort. > Otherwise, the system has a chance to run into use-after-free oops, > if the user-space handler sends "-1" to firmware controller(loading) in > exception scenarios before sending "1" to start a load. > See the attachment for the kernel log and the analysis > > Tested: > ARM_ca9 + android init uevent + webtop udev > > Patch: > diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c > index 06ed6b4..b333082 100644 > --- a/drivers/base/firmware_class.c > +++ b/drivers/base/firmware_class.c > @@ -271,7 +271,8 @@ static ssize_t firmware_loading_store(struct device *dev, > /* fallthrough */ > case -1: > err: > - fw_load_abort(fw_priv); > + if (fw_priv->fw) > + fw_load_abort(fw_priv); > break; > } >
Can you resend this in the format described in Documentation/SubmittingPatches so that I can accept it? (hint, you forgot the signed-off-by: line.)
Also, shouldn't we do the check for ->fw in the fw_load_abort() call?
And why is userspace doing wierd things like this? What causes that?
thanks,
greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |