lkml.org 
[lkml]   [2017]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 28/45] [media] dvb-usb-v2: avoid use-after-free
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Arnd Bergmann <arnd@arndb.de>

    commit 005145378c9ad7575a01b6ce1ba118fb427f583a upstream.

    I ran into a stack frame size warning because of the on-stack copy of
    the USB device structure:

    drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
    drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

    Copying a device structure like this is wrong for a number of other reasons
    too aside from the possible stack overflow. One of them is that the
    dev_info() call will print the name of the device later, but AFAICT
    we have only copied a pointer to the name earlier and the actual name
    has been freed by the time it gets printed.

    This removes the on-stack copy of the device and instead copies the
    device name using kstrdup(). I'm ignoring the possible failure here
    as both printk() and kfree() are able to deal with NULL pointers.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    --- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
    +++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
    @@ -1010,8 +1010,8 @@ EXPORT_SYMBOL(dvb_usbv2_probe);
    void dvb_usbv2_disconnect(struct usb_interface *intf)
    {
    struct dvb_usb_device *d = usb_get_intfdata(intf);
    - const char *name = d->name;
    - struct device dev = d->udev->dev;
    + const char *devname = kstrdup(dev_name(&d->udev->dev), GFP_KERNEL);
    + const char *drvname = d->name;

    dev_dbg(&d->udev->dev, "%s: bInterfaceNumber=%d\n", __func__,
    intf->cur_altsetting->desc.bInterfaceNumber);
    @@ -1021,8 +1021,9 @@ void dvb_usbv2_disconnect(struct usb_int

    dvb_usbv2_exit(d);

    - dev_info(&dev, "%s: '%s' successfully deinitialized and disconnected\n",
    - KBUILD_MODNAME, name);
    + pr_info("%s: '%s:%s' successfully deinitialized and disconnected\n",
    + KBUILD_MODNAME, drvname, devname);
    + kfree(devname);
    }
    EXPORT_SYMBOL(dvb_usbv2_disconnect);


    \
     
     \ /
      Last update: 2017-04-19 16:59    [W:3.231 / U:0.392 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site