raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

Fix firmware loader uevent buffer NULL pointer dereference

Browse Source 
commit 6f957724b9 upstream.

The firmware class uevent function accessed the "fw_priv->buf" buffer
without the proper locking and testing for NULL.  This is an old bug
(looks like it goes back to 2012 and commit 1244691c73: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering
only now in 4.2-rc1.

Shuah Khan is trying to bisect what it is that causes this to trigger
more easily, but in the meantime let's just fix the bug since others are
hitting it too (at least Ingo reports having seen it as well).

Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Linus Torvalds
2015-07-09 11:20:01 -07:00
committed by Greg Kroah-Hartman
parent 206f4fba0c
commit bf94e2202c
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/base/firmware_class.c
View File

@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
kfree(fw_priv);
}
static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
{
struct firmware_priv *fw_priv = to_firmware_priv(dev);
if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
return -ENOMEM;
if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
return 0;
}
static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
{
struct firmware_priv *fw_priv = to_firmware_priv(dev);
int err = 0;
mutex_lock(&fw_lock);
if (fw_priv->buf)
err = do_firmware_uevent(fw_priv, env);
mutex_unlock(&fw_lock);
return err;
}
static struct class firmware_class = {
.name = "firmware",
.class_attrs = firmware_class_attrs,