linux-kernel - Re: [PATCH] bus: fsl-mc: fix use-after-free in driver_override

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7to5mxgie6rpv4kxfcvt3lol3mp5qchzjlu5ayzkhnej4rs7gw@wyhtvzjugwer>
Date: Tue, 16 Dec 2025 15:22:16 +0200
From: Ioana Ciornei <ioana.ciornei@....com>
To: Gui-Dong Han <hanguidong02@...il.com>
Cc: linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org, 
	baijiaju1990@...il.com, stable@...r.kernel.org
Subject: Re: [PATCH] bus: fsl-mc: fix use-after-free in driver_override_show()

On Wed, Dec 03, 2025 at 01:44:38AM +0800, Gui-Dong Han wrote:
> The driver_override_show() function reads the driver_override string
> without holding the device_lock. However, driver_override_store() uses
> driver_set_override(), which modifies and frees the string while holding
> the device_lock.
> 
> This can result in a concurrent use-after-free if the string is freed
> by the store function while being read by the show function.
> 
> Fix this by holding the device_lock around the read operation.
> 
> Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
> Cc: stable@...r.kernel.org
> Signed-off-by: Gui-Dong Han <hanguidong02@...il.com>

Reviewed-by: Ioana Ciornei <ioana.ciornei@....com>

Thanks!