]> git.baikalelectronics.ru Git - kernel.git/commit
dmaengine: imx-sdma: fix use-after-free on probe error path
authorSven Van Asbroeck <thesven73@gmail.com>
Mon, 24 Jun 2019 14:07:31 +0000 (10:07 -0400)
committerVinod Koul <vkoul@kernel.org>
Fri, 5 Jul 2019 07:28:54 +0000 (12:58 +0530)
commit9218d6a90e36678dd698f28d7971a8752cfd1af9
tree815c860736e7ddbec938d8370d7d6caab4a93635
parentb6ba188898850f23d5fd80675f8fd4bddf1b8c11
dmaengine: imx-sdma: fix use-after-free on probe error path

If probe() fails anywhere beyond the point where
sdma_get_firmware() is called, then a kernel oops may occur.

Problematic sequence of events:
1. probe() calls sdma_get_firmware(), which schedules the
   firmware callback to run when firmware becomes available,
   using the sdma instance structure as the context
2. probe() encounters an error, which deallocates the
   sdma instance structure
3. firmware becomes available, firmware callback is
   called with deallocated sdma instance structure
4. use after free - kernel oops !

Solution: only attempt to load firmware when we're certain
that probe() will succeed. This guarantees that the firmware
callback's context will remain valid.

Note that the remove() path is unaffected by this issue: the
firmware loader will increment the driver module's use count,
ensuring that the module cannot be unloaded while the
firmware callback is pending or running.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
[vkoul: fixed braces for if condition]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
drivers/dma/imx-sdma.c