Skip to content

Commit 928ea98

Browse files
kawasakigregkh
authored andcommitted
bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f936271 ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 3ed8c7d commit 928ea98

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/bus/fsl-mc/fsl-mc-bus.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1239,14 +1239,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
12391239
static int fsl_mc_bus_remove(struct platform_device *pdev)
12401240
{
12411241
struct fsl_mc *mc = platform_get_drvdata(pdev);
1242+
struct fsl_mc_io *mc_io;
12421243

12431244
if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))
12441245
return -EINVAL;
12451246

1247+
mc_io = mc->root_mc_bus_dev->mc_io;
12461248
fsl_mc_device_remove(mc->root_mc_bus_dev);
1247-
1248-
fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io);
1249-
mc->root_mc_bus_dev->mc_io = NULL;
1249+
fsl_destroy_mc_io(mc_io);
12501250

12511251
bus_unregister_notifier(&fsl_mc_bus_type, &fsl_mc_nb);
12521252

0 commit comments

Comments
 (0)