lkml.org 
[lkml]   [2016]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 30/99] thunderbolt: Fix double free of drom buffer
    Date
    3.19.8-ckt23 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Andreas Noever <andreas.noever@gmail.com>

    commit 2ffa9a5d76a75abbc1f95c17959fced666095bdd upstream.

    If tb_drom_read() fails, sw->drom is freed but not set to NULL. sw->drom
    is then freed again in the error path of tb_switch_alloc().

    The bug can be triggered by unplugging a thunderbolt device shortly after
    it is detected by the thunderbolt driver.

    Clear sw->drom if tb_drom_read() fails.

    [bhelgaas: add Fixes:, stable versions of interest]
    Fixes: 343fcb8c70d7 ("thunderbolt: Fix nontrivial endpoint devices.")
    Signed-off-by: Andreas Noever <andreas.noever@gmail.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    CC: Lukas Wunner <lukas@wunner.de>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/thunderbolt/eeprom.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
    index 0dde34e..545c60c 100644
    --- a/drivers/thunderbolt/eeprom.c
    +++ b/drivers/thunderbolt/eeprom.c
    @@ -444,6 +444,7 @@ int tb_drom_read(struct tb_switch *sw)
    return tb_drom_parse_entries(sw);
    err:
    kfree(sw->drom);
    + sw->drom = NULL;
    return -EIO;

    }
    --
    2.7.4
    \
     
     \ /
      Last update: 2016-07-07 21:41    [W:4.252 / U:0.668 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site