* [PATCH] HSI: core: Fix return freed object in hsi_new_client
@ 2021-11-05 13:45 Chengfeng Ye
2021-11-05 13:46 ` 回复: " YE Chengfeng
0 siblings, 1 reply; 2+ messages in thread
From: Chengfeng Ye @ 2021-11-05 13:45 UTC (permalink / raw)
To: sre; +Cc: linux-kernel, Chengfeng Ye
cl is freed on error of calling device_register, but this
object is return later, which will cause uaf issue. Fix it
by return NULL on error.
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
drivers/hsi/hsi_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c
index ec90713564e3..884066109699 100644
--- a/drivers/hsi/hsi_core.c
+++ b/drivers/hsi/hsi_core.c
@@ -102,6 +102,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port,
if (device_register(&cl->device) < 0) {
pr_err("hsi: failed to register client: %s\n", info->name);
put_device(&cl->device);
+ goto err;
}
return cl;
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* 回复: [PATCH] HSI: core: Fix return freed object in hsi_new_client
2021-11-05 13:45 [PATCH] HSI: core: Fix return freed object in hsi_new_client Chengfeng Ye
@ 2021-11-05 13:46 ` YE Chengfeng
0 siblings, 0 replies; 2+ messages in thread
From: YE Chengfeng @ 2021-11-05 13:46 UTC (permalink / raw)
To: sre; +Cc: linux-kernel
Hi,
We send a patch for this suspected uaf issue. Would you like to have a look at it?
Best regards,
Chengfeng
-----邮件原件-----
发件人: YE Chengfeng
发送时间: 2021年11月5日 21:45
收件人: sre@kernel.org
抄送: linux-kernel@vger.kernel.org; YE Chengfeng <cyeaa@connect.ust.hk>
主题: [PATCH] HSI: core: Fix return freed object in hsi_new_client
cl is freed on error of calling device_register, but this object is return later, which will cause uaf issue. Fix it by return NULL on error.
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
drivers/hsi/hsi_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c index ec90713564e3..884066109699 100644
--- a/drivers/hsi/hsi_core.c
+++ b/drivers/hsi/hsi_core.c
@@ -102,6 +102,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port,
if (device_register(&cl->device) < 0) {
pr_err("hsi: failed to register client: %s\n", info->name);
put_device(&cl->device);
+ goto err;
}
return cl;
--
2.17.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-05 13:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-05 13:45 [PATCH] HSI: core: Fix return freed object in hsi_new_client Chengfeng Ye
2021-11-05 13:46 ` 回复: " YE Chengfeng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).