Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Anirudh Rayabharam d09639528b firmware_loader: fix use-after-free in firmware_fallback_sysfs ... commit 75d95e2e39b27f733f21e6668af1c9893a97de5e upstream. This use-after-free happens when a fw_priv object has been freed but hasn't been removed from the pending list (pending_fw_head). The next time fw_load_sysfs_fallback tries to insert into the list, it ends up accessing the pending_list member of the previously freed fw_priv. The root cause here is that all code paths that abort the fw load don't delete it from the pending list. For example: _request_firmware() -> fw_abort_batch_reqs() -> fw_state_aborted() To fix this, delete the fw_priv from the list in __fw_set_state() if the new state is DONE or ABORTED. This way, all aborts will remove the fw_priv from the list. Accordingly, remove calls to list_del_init that were being made before calling fw_state_(aborted|done). Also, in fw_load_sysfs_fallback, don't add the fw_priv to the pending list if it is already aborted. Instead, just jump out and return early. Fixes: bcfbd3523f3c ("firmware: fix a double abort case with fw_load_sysfs_fallback") Cc: stable <stable@vger.kernel.org> Reported-by: syzbot+de271708674e2093097b@syzkaller.appspotmail.com Tested-by: syzbot+de271708674e2093097b@syzkaller.appspotmail.com Reviewed-by: Shuah Khan <skhan@linuxfoundation.org> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com> Link: https://lore.kernel.org/r/20210728085107.4141-3-mail@anirudhrb.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-08-12 13:20:59 +02:00
..
firmware_loader	firmware_loader: fix use-after-free in firmware_fallback_sysfs	2021-08-12 13:20:59 +02:00
power	PM: runtime: Fix unpaired parent child_count for force_resume	2021-05-19 10:08:20 +02:00
regmap	regmap: set debugfs_name to NULL after it is freed	2021-05-14 09:44:17 +02:00
test
arch_topology.c	cpu-topology: Fix the potential data corruption	2020-10-01 13:17:40 +02:00
attribute_container.c
base.h
bus.c
cacheinfo.c
class.c
component.c	component: Silence bind error on -EPROBE_DEFER	2020-05-27 17:46:31 +02:00
container.c
core.c	driver core: Extend device_is_dependent()	2021-01-27 11:47:51 +01:00
cpu.c	x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation	2020-06-10 20:24:57 +02:00
dd.c	driver core: Fix locking bug in deferred_probe_timeout_work_func()	2021-04-16 11:46:38 +02:00
devcon.c
devcoredump.c
devres.c
devtmpfs.c
driver.c
firmware.c
hypervisor.c
init.c
isa.c
Kconfig
Makefile
map.c
memory.c
module.c
node.c	node: fix device cleanups in error handling code	2021-05-14 09:44:22 +02:00
pinctrl.c
platform-msi.c
platform.c	drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish	2020-06-24 17:50:24 +02:00
property.c
soc.c
swnode.c	software node: Fix node registration	2021-03-17 17:03:48 +01:00
syscore.c
topology.c
transport_class.c