linux-kernel - Re: [PATCH 1/2] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140319090707.GD31687@lee--X1>
Date:	Wed, 19 Mar 2014 09:07:07 +0000
From:	Lee Jones <lee.jones@...aro.org>
To:	Krzysztof Kozlowski <k.kozlowski@...sung.com>
Cc:	Samuel Ortiz <sameo@...ux.intel.com>, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH 1/2] mfd: tps65910: Fix possible invalid pointer
 dereference on regmap_add_irq_chip fail

> tps65910_irq_init() sets the 'tps65910->chip_irq' before calling
> regmap_add_irq_chip(). If this regmap_add_irq_chip() call fails in
> memory allocation of regmap_irq_chip_data members then:
> 1. The 'tps65910->chip_irq' will still hold some value;
> 2. 'tps65910->irq_data' will be pointing to already freed memory
>    (because regmap_add_irq_chip() will free it on error);
> 
> This results in invalid memory access during driver remove because the
> tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not null.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@...sung.com>
> Cc: <stable@...r.kernel.org>
> Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")
> ---
>  drivers/mfd/tps65910.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Applied after cleaning up the commit message a little.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/