Messages in this thread | | | Subject | Re: [PATCH] spmi: mediatek: Fix UAF on device remove | From | Stephen Boyd <> | Date | Mon, 23 Oct 2023 19:01:36 -0700 |
| |
Quoting Yu-Che Cheng (2023-07-17 02:39:35) > The pmif driver data that contains the clocks is allocated along with > spmi_controller. > On device remove, spmi_controller will be freed first, and then devres > , including the clocks, will be cleanup. > This leads to UAF because putting the clocks will access the clocks in > the pmif driver data, which is already freed along with spmi_controller. > > This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and > building the kernel with KASAN. > > Fix the UAF issue by using unmanaged clk_bulk_get() and putting the > clocks before freeing spmi_controller. > > Reported-by: Fei Shao <fshao@chromium.org> > Signed-off-by: Yu-Che Cheng <giver@chromium.org> > ---
Applied to spmi-next
| |