linux-kernel - Re: [PATCH] bus: fsl-mc: fix use-after-free in driver_override

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <176777167465.2143957.13769286595533147394.b4-ty@kernel.org>
Date: Wed,  7 Jan 2026 08:41:51 +0100
From: "Christophe Leroy (CS GROUP)" <chleroy@...nel.org>
To: ioana.ciornei@....com,
	Gui-Dong Han <hanguidong02@...il.com>
Cc: Christophe Leroy <chleroy@...nel.org>,
	linuxppc-dev@...ts.ozlabs.org,
	linux-kernel@...r.kernel.org,
	baijiaju1990@...il.com,
	stable@...r.kernel.org
Subject: Re: [PATCH] bus: fsl-mc: fix use-after-free in driver_override_show()


On Wed, 03 Dec 2025 01:44:38 +0800, Gui-Dong Han wrote:
> The driver_override_show() function reads the driver_override string
> without holding the device_lock. However, driver_override_store() uses
> driver_set_override(), which modifies and frees the string while holding
> the device_lock.
> 
> This can result in a concurrent use-after-free if the string is freed
> by the store function while being read by the show function.
> 
> [...]

Applied, thanks!

[1/1] bus: fsl-mc: fix use-after-free in driver_override_show()
      commit: 148891e95014b5dc5878acefa57f1940c281c431

Best regards,
-- 
Christophe Leroy (CS GROUP) <chleroy@...nel.org>