mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 21:03:32 +00:00
driver: base: fix UAF when driver_attach failed
[ Upstream commit310862e574
] When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed. Fixes:190888ac01
("driver core: fix possible missing of device probe") Signed-off-by: Schspa Shi <schspa@gmail.com> Link: https://lore.kernel.org/r/20220513112444.45112-1-schspa@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
0efa0391b7
commit
5389101257
1 changed files with 3 additions and 1 deletions
|
@ -617,7 +617,7 @@ int bus_add_driver(struct device_driver *drv)
|
|||
if (drv->bus->p->drivers_autoprobe) {
|
||||
error = driver_attach(drv);
|
||||
if (error)
|
||||
goto out_unregister;
|
||||
goto out_del_list;
|
||||
}
|
||||
module_add_driver(drv->owner, drv);
|
||||
|
||||
|
@ -644,6 +644,8 @@ int bus_add_driver(struct device_driver *drv)
|
|||
|
||||
return 0;
|
||||
|
||||
out_del_list:
|
||||
klist_del(&priv->knode_bus);
|
||||
out_unregister:
|
||||
kobject_put(&priv->kobj);
|
||||
/* drv->p is freed in driver_release() */
|
||||
|
|
Loading…
Reference in a new issue