linux-kernel - [PATCH 0/2] leds: spi-byte: fix regression introduced in stable kernels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241029204128.527033-1-pchelkin@ispras.ru>
Date: Tue, 29 Oct 2024 23:41:26 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Sasha Levin <sashal@...nel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	stable@...r.kernel.org
Cc: Fedor Pchelkin <pchelkin@...ras.ru>,
	Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
	Pavel Machek <pavel@....cz>,
	Lee Jones <lee@...nel.org>,
	linux-leds@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Stefan Kalscheuer <stefan@...lcode.de>,
	lvc-project@...uxtesting.org
Subject: [PATCH 0/2] leds: spi-byte: fix regression introduced in stable kernels

Upstream commit 7f9ab862e05c ("leds: spi-byte: Call of_node_put() on error path")
after being backported to 5.10/5.15/6.1/6.6 stable kernels introduced an
access-before-initialization error - it will most likely lead to a crash
in the probe function of the driver if there is no default zero
initialization for the stack values.

The commit moved the initialization of `struct device_node *child` lower
in code, while in stable kernels its value is used in between those places.
Git context of the patch does not cover the situation so it was applied
without any failures.

Upstream commit which removed that intermediate access to the variable is
ccc35ff2fd29 ("leds: spi-byte: Use devm_led_classdev_register_ext()").

I think it's worth a backport, too. The patches for the corresponding
stable trees follow in this thread.

Judging by Documentation/devicetree/bindings/leds/common.yaml, "label"
leds property is deprecated at least since the start of 2020. So there
should be no problem with switching from "label" to "function"+"color"
device name generation in kernels down to 5.10.y.

--
Fedor