kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/bus/fsl-mc
History
Gui-Dong Han 1d6bd6183e bus: fsl-mc: fix use-after-free in driver_override_show() 
commit 148891e950 upstream.

The driver_override_show() function reads the driver_override string
without holding the device_lock. However, driver_override_store() uses
driver_set_override(), which modifies and frees the string while holding
the device_lock.

This can result in a concurrent use-after-free if the string is freed
by the store function while being read by the show function.

Fix this by holding the device_lock around the read operation.

Fixes: 1f86a00c11 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-16 10:19:45 +01:00
..
dpbp.c bus: fsl-mc: remove duplicated include files 2018-12-06 15:53:20 +01:00
dpcon.c bus: fsl-mc: remove duplicated include files 2018-12-06 15:53:20 +01:00
dpmcp.c bus: fsl-mc: Remove deadcode 2025-03-21 09:46:08 +01:00
dprc-driver.c bus: fsl-mc: drop useless cleanup 2025-05-13 01:34:57 +02:00
dprc.c bus: fsl-mc: Use strscpy() instead of strscpy_pad() 2025-05-13 01:39:01 +02:00
fsl-mc-allocator.c bus: fsl-mc: drop useless cleanup 2025-05-13 01:34:57 +02:00
fsl-mc-bus.c bus: fsl-mc: fix use-after-free in driver_override_show() 2026-02-16 10:19:45 +01:00
fsl-mc-msi.c bus: Explicitly include correct DT includes 2023-08-12 10:31:01 +02:00
fsl-mc-private.h bus: fsl-mc: drop useless cleanup 2025-05-13 01:34:57 +02:00
fsl-mc-uapi.c bus: fsl-mc: add the dprc_get_mem() command to the whitelist 2025-05-13 01:34:57 +02:00
Kconfig genirq: Get rid of GENERIC_MSI_IRQ_DOMAIN 2022-11-17 15:15:20 +01:00
Makefile bus/fsl-mc: Add generic implementation for open/reset/close commands 2021-09-28 16:56:05 -06:00
mc-io.c bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device 2025-05-13 01:34:57 +02:00
mc-sys.c bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value 2025-05-13 01:34:57 +02:00
obj-api.c bus/fsl-mc: Add generic implementation for open/reset/close commands 2021-09-28 16:56:05 -06:00