kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/firmware
History
Hyunwoo Kim d46815a8f2 efi: capsule-loader: Fix use-after-free in efi_capsule_write 
commit 9cb636b5f6 upstream.

A race condition may occur if the user calls close() on another thread
during a write() operation on the device node of the efi capsule.

This is a race condition that occurs between the efi_capsule_write() and
efi_capsule_flush() functions of efi_capsule_fops, which ultimately
results in UAF.

So, the page freeing process is modified to be done in
efi_capsule_release() instead of efi_capsule_flush().

Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2022-09-15 10:47:07 +02:00
..
arm_ffa firmware: arm_ffa: Remove incorrect assignment of driver_data 2022-04-29 14:51:46 +01:00
arm_scmi firmware: arm_scmi: Remove usage of the deprecated ida_simple_xxx API 2022-06-27 16:58:14 +01:00
broadcom firmware: tee_bnxt: Use UUID API for exporting the UUID 2022-05-05 18:14:29 -07:00
cirrus firmware: cs_dsp: Fix overrun of unterminated control name string 2022-04-12 17:57:04 +01:00
efi efi: capsule-loader: Fix use-after-free in efi_capsule_write 2022-09-15 10:47:07 +02:00
google firmware: google: Properly state IOMEM dependency 2022-03-18 14:18:15 +01:00
imx firmware: imx: scu-pd: imx8q: add vpu mu resources 2022-02-20 14:55:32 +08:00
meson firmware: meson-sm: enable build as module 2020-10-26 13:36:05 -07:00
psci firmware/psci: fix application of sizeof to pointer 2021-10-26 17:40:54 -05:00
smccc printk: stop including cache.h from printk.h 2022-05-13 07:20:07 -07:00
tegra firmware: tegra: bpmp: Do only aligned access to IPC memory area 2022-09-05 10:31:26 +02:00
xilinx firmware: xilinx: enable feature check for ZynqMP 2022-04-22 17:20:03 +02:00
arm_scpi.c firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails 2022-08-17 15:16:07 +02:00
arm_sdei.c ACPI: APEI: explicit init of HEST and GHES in apci_init() 2022-03-03 20:24:22 +01:00
dmi-id.c firmware: dmi: Move product_sku info to the end of the modalias 2021-09-02 17:28:53 +02:00
dmi-sysfs.c firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle 2022-05-19 18:56:56 +02:00
dmi_scan.c ASoC: soc-core: fix DMI handling 2021-03-11 13:25:09 +00:00
edd.c edd: simplify the check of 'attr->test' in edd_populate_dir() 2022-05-19 18:57:04 +02:00
iscsi_ibft.c iscsi_ibft: Fix isa_bus_to_virt not working under ARM 2021-09-02 16:22:00 -04:00
iscsi_ibft_find.c iscsi_ibft: fix warning in reserve_ibft_region() 2021-08-05 19:47:57 -04:00
Kconfig sound updates for 5.19-rc1 2022-05-25 16:55:16 -07:00
Makefile Follow-up tweaks for the EFI changes in v5.19 2022-06-03 13:39:30 -07:00
memmap.c firmware: memmap: use default_groups in kobj_type 2022-01-05 19:17:29 +01:00
mtk-adsp-ipc.c firmware: mediatek: Add adsp ipc protocol interface 2022-05-16 12:58:11 +01:00
pcdp.c efi/ia64: Move HCDP and MPS table handling into IA64 arch code 2020-02-23 21:59:42 +01:00
pcdp.h firmware: pcdp: Replace zero-length array with flexible-array 2020-06-15 23:08:32 -05:00
qcom_scm-legacy.c firmware: qcom_scm: Fix kernel-doc function names to match 2021-04-06 21:25:49 -05:00
qcom_scm-smc.c firmware: qcom_scm: Reduce locking section for __get_convention() 2021-04-06 21:25:23 -05:00
qcom_scm.c firmware: qcom_scm: Add compatible for MSM8976 SoC 2022-04-12 21:36:19 -05:00
qcom_scm.h firmware: qcom: scm: Add support for MC boot address API 2022-02-03 21:54:48 -06:00
qemu_fw_cfg.c firmware: qemu_fw_cfg: remove sysfs entries explicitly 2022-01-14 18:50:52 -05:00
raspberrypi.c firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()' 2021-08-18 16:02:08 +02:00
scpi_pm_domain.c firmware: arm_scpi: Fix string overflow in SCPI genpd driver 2021-12-13 15:17:37 +01:00
stratix10-rsu.c firmware: stratix10-rsu: fix warnings 2020-07-02 14:48:48 +02:00
stratix10-svc.c firmware: stratix10-svc: fix a missing check on list iterator 2022-04-24 17:31:20 +02:00
sysfb.c firmware: sysfb: Add sysfb_disable() helper function 2022-06-29 09:51:41 +02:00
sysfb_simplefb.c firmware: sysfb: Make sysfb_create_simplefb() return a pdev pointer 2022-06-29 09:51:31 +02:00
ti_sci.c firmware: ti_sci: Switch transport to polled mode during system suspend 2022-05-03 06:52:11 -05:00
ti_sci.h firmware: ti_sci: rm: Add new ops for ring configuration 2020-11-01 19:38:02 -08:00
trusted_foundations.c firmware: tf: Different way of L2 cache enabling after LP2 suspend 2020-05-06 18:27:26 +02:00
turris-mox-rwtm.c mvebu drivers for 5.14 (part 1) 2021-06-23 18:57:40 -07:00