linux-kernel - Re: [PATCH] gpio: ml-ioh: Fix buffer underwrite on probe error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACRpkdZ1RuSOFh8_w0Ds4sC2rpJhVEEtuo=SzVxFLk4OggM7_A@mail.gmail.com>
Date:   Sun, 29 Jul 2018 23:13:42 +0200
From:   Linus Walleij <linus.walleij@...aro.org>
To:     vasilyev@...ras.ru
Cc:     "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        ldv-project@...uxtesting.org
Subject: Re: [PATCH] gpio: ml-ioh: Fix buffer underwrite on probe error path

On Mon, Jul 23, 2018 at 6:54 PM Anton Vasilyev <vasilyev@...ras.ru> wrote:

> If ioh_gpio_probe() fails on devm_irq_alloc_descs() then chip may point
> to any element of chip_save array, so reverse iteration from pointer chip
> may become chip_save[-1] and gpiochip_remove() will operate with wrong
> memory.
>
> The patch fix the error path of ioh_gpio_probe() to correctly bypass
> chip_save array.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Anton Vasilyev <vasilyev@...ras.ru>

Patch applied, nice work!

Yours,
Linus Walleij