From: Tzung-Bi Shih <tzungbi@kernel.org>
To: Benson Leung <bleung@chromium.org>
Cc: Gwendal Grignou <gwendal@chromium.org>, chrome-platform@lists.linux.dev
Subject: Re: [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
Date: Mon, 10 Nov 2025 06:32:22 +0000 [thread overview]
Message-ID: <aRGG9vUkldw_s2G2@google.com> (raw)
In-Reply-To: <20251031033900.3577394-1-tzungbi@kernel.org>
On Fri, Oct 31, 2025 at 03:39:00AM +0000, Tzung-Bi Shih wrote:
> After unbinding the driver, another kthread `cros_ec_console_log_work`
> is still accessing the device, resulting an UAF and crash.
>
> The driver doesn't unregister the EC device in .remove() which should
> shutdown sub-devices synchronously. Fix it.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next
[1/1] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
commit: 944edca81e7aea15f83cf9a13a6ab67f711e8abd
Thanks!
prev parent reply other threads:[~2025-11-10 6:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-31 3:39 [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver Tzung-Bi Shih
2025-11-10 6:32 ` Tzung-Bi Shih [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aRGG9vUkldw_s2G2@google.com \
--to=tzungbi@kernel.org \
--cc=bleung@chromium.org \
--cc=chrome-platform@lists.linux.dev \
--cc=gwendal@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.