lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 28 Dec 2020 13:48:56 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, Hulk Robot <hulkci@...wei.com>, Qinglang Miao <miaoqinglang@...wei.com>, Serge Semin <fancer.lancer@...il.com>, Thomas Bogendoerfer <tsbogend@...ha.franken.de>, Sasha Levin <sashal@...nel.org> Subject: [PATCH 4.9 083/175] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover From: Qinglang Miao <miaoqinglang@...wei.com> [ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ] kfree(dev) has been called inside put_device so anther kfree would cause a use-after-free bug/ Fixes: 8286ae03308c ("MIPS: Add CDMM bus support") Reported-by: Hulk Robot <hulkci@...wei.com> Signed-off-by: Qinglang Miao <miaoqinglang@...wei.com> Acked-by: Serge Semin <fancer.lancer@...il.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@...ha.franken.de> Signed-off-by: Sasha Levin <sashal@...nel.org> --- drivers/bus/mips_cdmm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c index 1b14256376d24..7c1da45be166e 100644 --- a/drivers/bus/mips_cdmm.c +++ b/drivers/bus/mips_cdmm.c @@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus) dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id); ++id; ret = device_register(&dev->dev); - if (ret) { + if (ret) put_device(&dev->dev); - kfree(dev); - } } } -- 2.27.0
Powered by blists - more mailing lists