]> git.baikalelectronics.ru Git - kernel.git/commit
Fix firmware loader uevent buffer NULL pointer dereference
authorLinus Torvalds <torvalds@linux-foundation.org>
Thu, 9 Jul 2015 18:20:01 +0000 (11:20 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 9 Jul 2015 18:20:01 +0000 (11:20 -0700)
commit7fbdb31b4a154cf7b4e9bc5d131c15ffefe9a697
treea5f0dc7258865efa5c39e80cf729f7db5d0c970f
parent1022e0378db3c945d9df3a18450e7b9a4ad35bee
Fix firmware loader uevent buffer NULL pointer dereference

The firmware class uevent function accessed the "fw_priv->buf" buffer
without the proper locking and testing for NULL.  This is an old bug
(looks like it goes back to 2012 and commit fbd43c5388f3: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering
only now in 4.2-rc1.

Shuah Khan is trying to bisect what it is that causes this to trigger
more easily, but in the meantime let's just fix the bug since others are
hitting it too (at least Ingo reports having seen it as well).

Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/base/firmware_class.c