* [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
@ 2025-10-31 3:39 Tzung-Bi Shih
2025-11-10 6:32 ` Tzung-Bi Shih
0 siblings, 1 reply; 2+ messages in thread
From: Tzung-Bi Shih @ 2025-10-31 3:39 UTC (permalink / raw)
To: Benson Leung; +Cc: Gwendal Grignou, chrome-platform, tzungbi
After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.
The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously. Fix it.
Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
drivers/platform/chrome/cros_ec_ishtp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
index 4e74e702c5a2..3766cef81fe8 100644
--- a/drivers/platform/chrome/cros_ec_ishtp.c
+++ b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -667,6 +667,7 @@ static void cros_ec_ishtp_remove(struct ishtp_cl_device *cl_device)
cancel_work_sync(&client_data->work_ishtp_reset);
cancel_work_sync(&client_data->work_ec_evt);
+ cros_ec_unregister(client_data->ec_dev);
cros_ish_deinit(cros_ish_cl);
ishtp_put_device(cl_device);
}
--
2.51.2.997.g839fc31de9-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
2025-10-31 3:39 [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver Tzung-Bi Shih
@ 2025-11-10 6:32 ` Tzung-Bi Shih
0 siblings, 0 replies; 2+ messages in thread
From: Tzung-Bi Shih @ 2025-11-10 6:32 UTC (permalink / raw)
To: Benson Leung; +Cc: Gwendal Grignou, chrome-platform
On Fri, Oct 31, 2025 at 03:39:00AM +0000, Tzung-Bi Shih wrote:
> After unbinding the driver, another kthread `cros_ec_console_log_work`
> is still accessing the device, resulting an UAF and crash.
>
> The driver doesn't unregister the EC device in .remove() which should
> shutdown sub-devices synchronously. Fix it.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next
[1/1] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
commit: 944edca81e7aea15f83cf9a13a6ab67f711e8abd
Thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-10 6:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-31 3:39 [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver Tzung-Bi Shih
2025-11-10 6:32 ` Tzung-Bi Shih
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox