* [PATCH] platform/chrome: wilco_ec: fix use after free issue
@ 2019-11-30 13:08 Wen Yang
2019-12-02 11:16 ` Enric Balletbo i Serra
0 siblings, 1 reply; 2+ messages in thread
From: Wen Yang @ 2019-11-30 13:08 UTC (permalink / raw)
To: Benson Leung, Enric Balletbo i Serra
Cc: xlpang, Wen Yang, Nick Crews, linux-kernel
This is caused by dereferencing 'dev_data' after put_device() in
the telem_device_remove() function.
This patch just moves the put_device() down a bit to avoid this
issue.
Fixes: 1210d1e6bad1 ("platform/chrome: wilco_ec: Add telemetry char device interface")
Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Benson Leung <bleung@chromium.org>
Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Cc: Nick Crews <ncrews@chromium.org>
Cc: linux-kernel@vger.kernel.org
---
drivers/platform/chrome/wilco_ec/telemetry.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/chrome/wilco_ec/telemetry.c b/drivers/platform/chrome/wilco_ec/telemetry.c
index b9d03c3..1176d54 100644
--- a/drivers/platform/chrome/wilco_ec/telemetry.c
+++ b/drivers/platform/chrome/wilco_ec/telemetry.c
@@ -406,8 +406,8 @@ static int telem_device_remove(struct platform_device *pdev)
struct telem_device_data *dev_data = platform_get_drvdata(pdev);
cdev_device_del(&dev_data->cdev, &dev_data->dev);
- put_device(&dev_data->dev);
ida_simple_remove(&telem_ida, MINOR(dev_data->dev.devt));
+ put_device(&dev_data->dev);
return 0;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] platform/chrome: wilco_ec: fix use after free issue
2019-11-30 13:08 [PATCH] platform/chrome: wilco_ec: fix use after free issue Wen Yang
@ 2019-12-02 11:16 ` Enric Balletbo i Serra
0 siblings, 0 replies; 2+ messages in thread
From: Enric Balletbo i Serra @ 2019-12-02 11:16 UTC (permalink / raw)
To: Wen Yang, Benson Leung; +Cc: xlpang, Nick Crews, linux-kernel
Hi Wen,
On 30/11/19 14:08, Wen Yang wrote:
> This is caused by dereferencing 'dev_data' after put_device() in
> the telem_device_remove() function.
> This patch just moves the put_device() down a bit to avoid this
> issue.
>
> Fixes: 1210d1e6bad1 ("platform/chrome: wilco_ec: Add telemetry char device interface")
> Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
> Cc: Benson Leung <bleung@chromium.org>
> Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com>
> Cc: Nick Crews <ncrews@chromium.org>
> Cc: linux-kernel@vger.kernel.org
> ---
Queued for 5.5 as is a fix.
Thanks.
Enric
> drivers/platform/chrome/wilco_ec/telemetry.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/platform/chrome/wilco_ec/telemetry.c b/drivers/platform/chrome/wilco_ec/telemetry.c
> index b9d03c3..1176d54 100644
> --- a/drivers/platform/chrome/wilco_ec/telemetry.c
> +++ b/drivers/platform/chrome/wilco_ec/telemetry.c
> @@ -406,8 +406,8 @@ static int telem_device_remove(struct platform_device *pdev)
> struct telem_device_data *dev_data = platform_get_drvdata(pdev);
>
> cdev_device_del(&dev_data->cdev, &dev_data->dev);
> - put_device(&dev_data->dev);
> ida_simple_remove(&telem_ida, MINOR(dev_data->dev.devt));
> + put_device(&dev_data->dev);
>
> return 0;
> }
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-12-02 11:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-30 13:08 [PATCH] platform/chrome: wilco_ec: fix use after free issue Wen Yang
2019-12-02 11:16 ` Enric Balletbo i Serra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).