Messages in this thread Patch in this message | | | Date | Tue, 19 Sep 2023 14:27:06 +0200 | From | Sebastian Reichel <> | Subject | Re: [PATCH] power: supply: Fix info use-after-free |
| |
Hi,
On Tue, Sep 19, 2023 at 07:33:01AM +0000, Vincent Whitchurch wrote: > On Mon, 2023-09-18 at 17:04 +0200, Sebastian Reichel wrote: > > diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c > > index 06e5b6b0e255..d483a81560ab 100644 > > --- a/drivers/power/supply/power_supply_sysfs.c > > +++ b/drivers/power/supply/power_supply_sysfs.c > > @@ -482,6 +482,13 @@ int power_supply_uevent(const struct device *dev, struct kobj_uevent_env *env) > > if (ret) > > return ret; > > > > > > + /* > > + * Kernel generates KOBJ_REMOVE uevent in device removal path, after > > + * resources have been freed. Exit early to avoid use-after-free. > > + */ > > + if (psy->removing) > > + return 0; > > + > > prop_buf = (char *)get_zeroed_page(GFP_KERNEL); > > if (!prop_buf) > > return -ENOMEM; > > > > That would also cover the no-parent-device part and avoid the > > device(s) being queried for data at device removal time, which > > wouldn't work if the device removal happens due to a hot-unplug. > > Works for me. > > Tested-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Ok, I added it to power-supply's fixes branch as 3dc0bab23dba53f315c9a7b4a679e0a6d46f7c6e.
-- Sebastian [unhandled content-type:application/pgp-signature] | |