* [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()
@ 2020-02-05 12:32 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2020-02-05 12:32 UTC (permalink / raw)
To: Vaibhav Agarwal, Dinko Mironov
Cc: devel, Alex Elder, kernel-janitors, Mark Greer, Johan Hovold,
greybus-dev, Greg Kroah-Hartman
When we call kobject_put() and it's the last reference to the kobject
then it calls gb_audio_module_release() and frees module. We dereference
"module" on the next line which is a use after free.
Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/staging/greybus/audio_manager.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
index 9b19ea9d3fa1..9a3f7c034ab4 100644
--- a/drivers/staging/greybus/audio_manager.c
+++ b/drivers/staging/greybus/audio_manager.c
@@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
list_for_each_entry_safe(module, next, &modules_list, list) {
list_del(&module->list);
- kobject_put(&module->kobj);
ida_simple_remove(&module_id, module->id);
+ kobject_put(&module->kobj);
}
is_empty = list_empty(&modules_list);
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()
@ 2020-02-05 12:32 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2020-02-05 12:32 UTC (permalink / raw)
To: Vaibhav Agarwal, Dinko Mironov
Cc: devel, Alex Elder, kernel-janitors, Mark Greer, Johan Hovold,
greybus-dev, Greg Kroah-Hartman
When we call kobject_put() and it's the last reference to the kobject
then it calls gb_audio_module_release() and frees module. We dereference
"module" on the next line which is a use after free.
Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/staging/greybus/audio_manager.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
index 9b19ea9d3fa1..9a3f7c034ab4 100644
--- a/drivers/staging/greybus/audio_manager.c
+++ b/drivers/staging/greybus/audio_manager.c
@@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
list_for_each_entry_safe(module, next, &modules_list, list) {
list_del(&module->list);
- kobject_put(&module->kobj);
ida_simple_remove(&module_id, module->id);
+ kobject_put(&module->kobj);
}
is_empty = list_empty(&modules_list);
--
2.11.0
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()
2020-02-05 12:32 ` Dan Carpenter
@ 2020-02-06 13:18 ` Vaibhav Agarwal
-1 siblings, 0 replies; 6+ messages in thread
From: Vaibhav Agarwal @ 2020-02-06 13:06 UTC (permalink / raw)
To: Dan Carpenter
Cc: devel, Alex Elder, Mark Greer, kernel-janitors, Johan Hovold,
Dinko Mironov, greybus-dev, Greg Kroah-Hartman
On Wed, Feb 5, 2020 at 6:02 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> When we call kobject_put() and it's the last reference to the kobject
> then it calls gb_audio_module_release() and frees module. We dereference
> "module" on the next line which is a use after free.
>
> Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/staging/greybus/audio_manager.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
> index 9b19ea9d3fa1..9a3f7c034ab4 100644
> --- a/drivers/staging/greybus/audio_manager.c
> +++ b/drivers/staging/greybus/audio_manager.c
> @@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
>
> list_for_each_entry_safe(module, next, &modules_list, list) {
> list_del(&module->list);
> - kobject_put(&module->kobj);
> ida_simple_remove(&module_id, module->id);
> + kobject_put(&module->kobj);
> }
>
> is_empty = list_empty(&modules_list);
> --
> 2.11.0
>
Thanks Dan for sharing the fix.
Reviewed-by: Vaibhav Agarwal <vaibhav.sr@gmail.com>
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()
@ 2020-02-06 13:18 ` Vaibhav Agarwal
0 siblings, 0 replies; 6+ messages in thread
From: Vaibhav Agarwal @ 2020-02-06 13:18 UTC (permalink / raw)
To: Dan Carpenter
Cc: devel, Alex Elder, Mark Greer, kernel-janitors, Johan Hovold,
Dinko Mironov, greybus-dev, Greg Kroah-Hartman
On Wed, Feb 5, 2020 at 6:02 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> When we call kobject_put() and it's the last reference to the kobject
> then it calls gb_audio_module_release() and frees module. We dereference
> "module" on the next line which is a use after free.
>
> Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/staging/greybus/audio_manager.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
> index 9b19ea9d3fa1..9a3f7c034ab4 100644
> --- a/drivers/staging/greybus/audio_manager.c
> +++ b/drivers/staging/greybus/audio_manager.c
> @@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
>
> list_for_each_entry_safe(module, next, &modules_list, list) {
> list_del(&module->list);
> - kobject_put(&module->kobj);
> ida_simple_remove(&module_id, module->id);
> + kobject_put(&module->kobj);
> }
>
> is_empty = list_empty(&modules_list);
> --
> 2.11.0
>
Thanks Dan for sharing the fix.
Reviewed-by: Vaibhav Agarwal <vaibhav.sr@gmail.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [greybus-dev] [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()
2020-02-05 12:32 ` Dan Carpenter
@ 2020-02-07 4:37 ` Viresh Kumar
-1 siblings, 0 replies; 6+ messages in thread
From: Viresh Kumar @ 2020-02-07 4:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: devel, Alex Elder, Vaibhav Agarwal, kernel-janitors,
Johan Hovold, Dinko Mironov, greybus-dev, Greg Kroah-Hartman
On 05-02-20, 15:32, Dan Carpenter wrote:
> When we call kobject_put() and it's the last reference to the kobject
> then it calls gb_audio_module_release() and frees module. We dereference
> "module" on the next line which is a use after free.
>
> Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/staging/greybus/audio_manager.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
> index 9b19ea9d3fa1..9a3f7c034ab4 100644
> --- a/drivers/staging/greybus/audio_manager.c
> +++ b/drivers/staging/greybus/audio_manager.c
> @@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
>
> list_for_each_entry_safe(module, next, &modules_list, list) {
> list_del(&module->list);
> - kobject_put(&module->kobj);
> ida_simple_remove(&module_id, module->id);
> + kobject_put(&module->kobj);
> }
>
> is_empty = list_empty(&modules_list);
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
--
viresh
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [greybus-dev] [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()
@ 2020-02-07 4:37 ` Viresh Kumar
0 siblings, 0 replies; 6+ messages in thread
From: Viresh Kumar @ 2020-02-07 4:37 UTC (permalink / raw)
To: Dan Carpenter
Cc: devel, Alex Elder, Vaibhav Agarwal, kernel-janitors,
Johan Hovold, Dinko Mironov, greybus-dev, Greg Kroah-Hartman
On 05-02-20, 15:32, Dan Carpenter wrote:
> When we call kobject_put() and it's the last reference to the kobject
> then it calls gb_audio_module_release() and frees module. We dereference
> "module" on the next line which is a use after free.
>
> Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/staging/greybus/audio_manager.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
> index 9b19ea9d3fa1..9a3f7c034ab4 100644
> --- a/drivers/staging/greybus/audio_manager.c
> +++ b/drivers/staging/greybus/audio_manager.c
> @@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
>
> list_for_each_entry_safe(module, next, &modules_list, list) {
> list_del(&module->list);
> - kobject_put(&module->kobj);
> ida_simple_remove(&module_id, module->id);
> + kobject_put(&module->kobj);
> }
>
> is_empty = list_empty(&modules_list);
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
--
viresh
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-02-07 4:37 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-05 12:32 [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all() Dan Carpenter
2020-02-05 12:32 ` Dan Carpenter
2020-02-06 13:06 ` Vaibhav Agarwal
2020-02-06 13:18 ` Vaibhav Agarwal
2020-02-07 4:25 ` [greybus-dev] " Viresh Kumar
2020-02-07 4:37 ` Viresh Kumar
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.