linux-kernel - Re: [PATCH 7/7] firmware: firmware: fix NULL pointer dereference in __fw_load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 25 Jan 2017 15:41:21 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     "Luis R. Rodriguez" <mcgrof@...nel.org>
Cc:     ming.lei@...onical.com, keescook@...omium.org,
        linux-kernel-dev@...khoff.com, jakub.kicinski@...ronome.com,
        chris@...is-wilson.co.uk, oss-drivers@...ronome.com,
        johannes@...solutions.net, j@...fi, teg@...m.no, kay@...y.org,
        jwboyer@...oraproject.org, dmitry.torokhov@...il.com,
        seth.forshee@...onical.com, bjorn.andersson@...aro.org,
        linux-kernel@...r.kernel.org, wagi@...om.org,
        stephen.boyd@...aro.org, zohar@...ux.vnet.ibm.com, tiwai@...e.de,
        dwmw2@...radead.org, fengguang.wu@...el.com, dhowells@...hat.com,
        arend.vanspriel@...adcom.com, kvalo@...eaurora.org,
        "[3.10+]" <stable@...r.kernel.org>
Subject: Re: [PATCH 7/7] firmware: firmware: fix NULL pointer dereference in
 __fw_load_abort()

On Wed, Jan 25, 2017 at 02:42:50PM +0100, Luis R. Rodriguez wrote:
> On Wed, Jan 25, 2017 at 02:36:31PM +0100, Luis R. Rodriguez wrote:
> > On Wed, Jan 25, 2017 at 11:52:04AM +0100, Greg KH wrote:
> > > On Mon, Jan 23, 2017 at 08:11:11AM -0800, Luis R. Rodriguez wrote:
> > > > Since commit 5d47ec02c37ea632398cb251c884e3a488dff794
> > > > ("firmware: Correct handling of fw_state_wait() return value")
> > > > fw_load_abort(fw_priv) could be called twice and lead us to a
> > > > kernel crash. This happens only when the firmware fallback mechanism
> > > > (regular or custom) is used. The fallback mechanism exposes a sysfs
> > > > interface for userspace to upload a file and notify the kernel when
> > > > the file is loaded and ready, or to cancel an upload by echo'ing -1
> > > > into on the loading file:
> > > > 
> > > > echo -n "-1" > /sys/$DEVPATH/loading
> > > > 
> > > > This will call fw_load_abort(). Some distributions actually have
> > > > a udev rule in place to *always* immediately cancel all firmware
> > > > fallback mechanism requests (Debian, OpenSUSE), they have:
> 
> I made a typo here, OpenSUSE in fact does not carry this. Its so far
> only Debian I am aware of.
> 
> > > >   $ cat /lib/udev/rules.d/50-firmware.rules
> > > >   # stub for immediately telling the kernel that userspace firmware loading
> > > >   # failed; necessary to avoid long timeouts with CONFIG_FW_LOADER_USER_HELPER=y
> > > >   SUBSYSTEM=="firmware", ACTION=="add", ATTR{loading}="-1

Please resend this as a single patch, to be applied to 4.10-final, with
the above fix, and I will be glad to take it.  Never mix patches in a
series that are for -final and for -next.

thanks,

greg k-h