kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/platform/chrome
History
Tzung-Bi Shih e1da6e399d platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver 
commit 944edca81e upstream.

After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.

The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously.  Fix it.

Fixes: 26a14267af ("platform/chrome: Add ChromeOS EC ISHTP driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-19 13:09:52 +01:00
..
wilco_ec platform/chrome: wilco_ec: convert stream-like files from nonseekable_open -> stream_open 2021-03-30 18:25:22 +02:00
chromeos_laptop.c platform/chrome: fix double-free in chromeos_laptop_prepare() 2022-10-26 12:34:52 +02:00
chromeos_pstore.c chrome platform changes for 5.8 2020-06-04 10:54:45 -07:00
chromeos_tbmc.c platform/chrome: chromeos_tbmc: Report wake events 2019-09-12 16:01:35 +02:00
cros_ec.c platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() 2025-08-28 16:24:32 +02:00
cros_ec.h platform/chrome: cros_ec: Make cros_ec_unregister() return void 2025-08-28 16:24:32 +02:00
cros_ec_chardev.c platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl 2023-03-30 12:47:50 +02:00
cros_ec_debugfs.c platform/chrome: cros_ec_debugfs: fix wrong EC message version 2024-08-19 05:44:49 +02:00
cros_ec_i2c.c platform/chrome: cros_ec: Make cros_ec_unregister() return void 2025-08-28 16:24:32 +02:00
cros_ec_ishtp.c platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver 2026-01-19 13:09:52 +01:00
cros_ec_lightbar.c platform/chrome: Constify static attribute_group structs 2021-01-20 16:19:17 +01:00
cros_ec_lpc.c platform/chrome: cros_ec: Make cros_ec_unregister() return void 2025-08-28 16:24:32 +02:00
cros_ec_lpc_mec.c platform/chrome: cros_ec_lpc: Use DEFINE_MUTEX() for mutex lock 2021-04-21 10:00:30 +02:00
cros_ec_lpc_mec.h platform/chrome: cros_ec: Remove cros_ec dependency in lpc_mec 2019-02-11 10:07:40 +01:00
cros_ec_proto.c platform/chrome: cros_ec_proto: Lock device when updating MKBP version 2024-08-19 05:45:33 +02:00
cros_ec_rpmsg.c platform/chrome: cros_ec: Call interrupt bottom half in ISH or RPMSG mode 2021-01-22 08:50:27 +01:00
cros_ec_sensorhub.c platform/chrome: cros_ec_sensorhub: Allocate sensorhub resource before claiming sensors 2020-04-29 23:17:45 +02:00
cros_ec_sensorhub_ring.c platform: chrome: Split trace include file 2022-04-08 14:24:07 +02:00
cros_ec_sensorhub_trace.h platform: chrome: Split trace include file 2022-04-08 14:24:07 +02:00
cros_ec_spi.c platform/chrome: cros_ec: Make cros_ec_unregister() return void 2025-08-28 16:24:32 +02:00
cros_ec_sysfs.c platform/chrome: cros_ec_sysfs: Add cold-ap-off to sysfs reboot. 2021-01-20 16:19:17 +01:00
cros_ec_trace.c platform/chrome: cros_ec: Add command for regulator control. 2020-06-15 22:40:14 +01:00
cros_ec_trace.h platform: chrome: Split trace include file 2022-04-08 14:24:07 +02:00
cros_ec_typec.c platform/chrome: cros_ec_typec: Defer probe on missing EC parent 2025-08-28 16:24:19 +02:00
cros_ec_vbc.c platform/chrome: Constify static attribute_group structs 2021-01-20 16:19:17 +01:00
cros_kbd_led_backlight.c platform/chrome: cros_kbd_led_backlight: switch to SPDX identifier 2019-02-01 10:13:06 +01:00
cros_usbpd_logger.c platform/chrome: cros_usbpd_logger: Add __printf annotation to append_str() 2020-05-04 14:02:01 -07:00
cros_usbpd_notify.c platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() 2022-12-31 13:14:02 +01:00
Kconfig platform/chrome: Kconfig: Remove the transitional MFD_CROS_EC config 2020-09-04 09:30:04 +02:00
Makefile platform: chrome: Split trace include file 2022-04-08 14:24:07 +02:00