gpiolib: Fix possible use after free on label

Browse source

[ Upstream commit 18534df419 ]

gpiod_request_commit() copies the pointer to the label passed as
an argument only to be used later. But there's a chance the caller
could immediately free the passed string(e.g., local variable).
This could trigger a use after free when we use gpio label(e.g.,
gpiochip_unlock_as_irq(), gpiochip_is_requested()).

To be on the safe side: duplicate the string with kstrdup_const()
so that if an unaware user passes an address to a stack-allocated
buffer, we won't get the arbitrary label.

Also fix gpiod_set_consumer_name().

Signed-off-by: Muchun Song <smuchun@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Muchun Song 2018-11-01 21:12:50 +08:00 • committed by Greg Kroah-Hartman

parent 83e25ef2b8

commit 4672971c82

2 changed files with 25 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

25

drivers/gpio/gpiolib.c

View file

6

include/linux/gpio/consumer.h

View file