Messages in this thread | | | Date | Mon, 29 Aug 2022 14:49:11 -0700 (PDT) | From | matthew.gerlach@linux ... | Subject | Re: [PATCH v2 1/1] firmware_loader: Fix use-after-free during unregister |
| |
On Mon, 29 Aug 2022, Russ Weight wrote:
> In the following code within firmware_upload_unregister(), the call to > device_unregister() could result in the dev_release function freeing the > fw_upload_priv structure before it is dereferenced for the call to > module_put(). This bug was found by the kernel test robot using > CONFIG_KASAN while running the firmware selftests. > > device_unregister(&fw_sysfs->dev); > module_put(fw_upload_priv->module); > > The problem is fixed by copying fw_upload_priv->module to a local variable > for use when calling device_unregister(). > > Reported-by: kernel test robot <oliver.sang@intel.com> > Fixes: 97730bbb242c ("firmware_loader: Add firmware-upload support") > Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Looks good to me.
Reviewed-by: Matthew Gerlach <matthew.gerlach@linux.intel.com> > --- > v2: Rebased to latest linux-next branch (next-20220829) > --- > drivers/base/firmware_loader/sysfs_upload.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/base/firmware_loader/sysfs_upload.c b/drivers/base/firmware_loader/sysfs_upload.c > index 87044d52322a..63e15bddd80c 100644 > --- a/drivers/base/firmware_loader/sysfs_upload.c > +++ b/drivers/base/firmware_loader/sysfs_upload.c > @@ -377,6 +377,7 @@ void firmware_upload_unregister(struct fw_upload *fw_upload) > { > struct fw_sysfs *fw_sysfs = fw_upload->priv; > struct fw_upload_priv *fw_upload_priv = fw_sysfs->fw_upload_priv; > + struct module *module = fw_upload_priv->module; > > mutex_lock(&fw_upload_priv->lock); > if (fw_upload_priv->progress == FW_UPLOAD_PROG_IDLE) { > @@ -392,6 +393,6 @@ void firmware_upload_unregister(struct fw_upload *fw_upload) > > unregister: > device_unregister(&fw_sysfs->dev); > - module_put(fw_upload_priv->module); > + module_put(module); > } > EXPORT_SYMBOL_GPL(firmware_upload_unregister); > -- > 2.25.1 > >
| |