mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries
Commitfe3c606843
("firmware: Fix a reference count leak.") "fixed" a kobject leak in the file registration helper by properly calling kobject_put() for the entry in case registration of the object fails (e.g. due to a name collision). This would however result in a NULL pointer dereference when the release function tries to remove the never added entry from the fw_cfg_entry_cache list. Fix this by moving the list-removal out of the release function. Note that the offending commit was one of the benign looking umn.edu fixes which was reviewed but not reverted. [1][2] [1] https://lore.kernel.org/r/202105051005.49BFABCE@keescook [2] https://lore.kernel.org/all/YIg7ZOZvS3a8LjSv@kroah.com Fixes:fe3c606843
("firmware: Fix a reference count leak.") Cc: stable@vger.kernel.org # 5.8 Cc: Qiushi Wu <wu000273@umn.edu> Cc: Kees Cook <keescook@chromium.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20211201132528.30025-2-johan@kernel.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
parent
28cc408be7
commit
d3e305592d
1 changed files with 1 additions and 4 deletions
|
@ -388,9 +388,7 @@ static void fw_cfg_sysfs_cache_cleanup(void)
|
|||
struct fw_cfg_sysfs_entry *entry, *next;
|
||||
|
||||
list_for_each_entry_safe(entry, next, &fw_cfg_entry_cache, list) {
|
||||
/* will end up invoking fw_cfg_sysfs_cache_delist()
|
||||
* via each object's release() method (i.e. destructor)
|
||||
*/
|
||||
fw_cfg_sysfs_cache_delist(entry);
|
||||
kobject_put(&entry->kobj);
|
||||
}
|
||||
}
|
||||
|
@ -448,7 +446,6 @@ static void fw_cfg_sysfs_release_entry(struct kobject *kobj)
|
|||
{
|
||||
struct fw_cfg_sysfs_entry *entry = to_entry(kobj);
|
||||
|
||||
fw_cfg_sysfs_cache_delist(entry);
|
||||
kfree(entry);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue