Messages in this thread Patch in this message | | | From | korantwork@gmail ... | Subject | [PATCH] firmware: fix one UAF issue | Date | Thu, 12 Jan 2023 15:05:03 +0800 |
| |
From: Xinghui Li <korantli@tencent.com>
There could be the use after free issue in dmi_sysfs_register_handle. During handling specializations process, the entry->child could be free if the error occurs. However, it will be kobject_put after free. So, we set the entry->child to NULL to avoid above case.
Reported-by: loydlv <loydlv@tencent.com> Signed-off-by: Xinghui Li <korantli@tencent.com> --- drivers/firmware/dmi-sysfs.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c index 66727ad3361b..dd4ff5f7e200 100644 --- a/drivers/firmware/dmi-sysfs.c +++ b/drivers/firmware/dmi-sysfs.c @@ -470,6 +470,7 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry) kobject_del(entry->child); out_free: kfree(entry->child); + entry->child = NULL; return ret; } -- 2.31.1
| |