linux-kernel - Re: [PATCH iio-next] iio: proximity: Fix use-after-free in hx9023s_send

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250112115314.2e5ad298@jic23-huawei>
Date: Sun, 12 Jan 2025 11:53:14 +0000
From: Jonathan Cameron <jic23@...nel.org>
To: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@...il.com>
Cc: lars@...afoo.de, jstephan@...libre.com, yasin.lee.x@...il.com,
 dan.carpenter@...aro.org, nuno.sa@...log.com, linux-iio@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH iio-next] iio: proximity: Fix use-after-free in
 hx9023s_send_cfg()

On Tue,  7 Jan 2025 18:05:10 +0530
Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@...il.com> wrote:

> Reorder the assignment of fw_size to happen before release_firmware()
> to avoid accessing the firmware structure after it's been freed.
> 
> Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality")
> Closes: https://scan7.scan.coverity.com/#/project-view/52337/11354?selectedIssue=1602791
> Signed-off-by: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@...il.com>
Gah. I didn't see this until after I'd sent the pull request.
Never mind, we have plenty of time to get this in during the rc1 cycles.

I'll queue it up after rc1.

Thanks,

Jonathan

> ---
>  drivers/iio/proximity/hx9023s.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c
> index e092a935dbac..5aa8e5a22f32 100644
> --- a/drivers/iio/proximity/hx9023s.c
> +++ b/drivers/iio/proximity/hx9023s.c
> @@ -1036,12 +1036,13 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data
>  		return -ENOMEM;
>  
>  	memcpy(bin->data, fw->data, fw->size);
> -	release_firmware(fw);
>  
>  	bin->fw_size = fw->size;
>  	bin->fw_ver = bin->data[FW_VER_OFFSET];
>  	bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET);
>  
> +	release_firmware(fw);
> +
>  	return hx9023s_bin_load(data, bin);
>  }
>