* [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
@ 2025-10-31 3:39 Tzung-Bi Shih
2025-11-10 6:32 ` Tzung-Bi Shih
0 siblings, 1 reply; 2+ messages in thread
From: Tzung-Bi Shih @ 2025-10-31 3:39 UTC (permalink / raw)
To: Benson Leung; +Cc: Gwendal Grignou, chrome-platform, tzungbi
After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.
The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously. Fix it.
Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
drivers/platform/chrome/cros_ec_ishtp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
index 4e74e702c5a2..3766cef81fe8 100644
--- a/drivers/platform/chrome/cros_ec_ishtp.c
+++ b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -667,6 +667,7 @@ static void cros_ec_ishtp_remove(struct ishtp_cl_device *cl_device)
cancel_work_sync(&client_data->work_ishtp_reset);
cancel_work_sync(&client_data->work_ec_evt);
+ cros_ec_unregister(client_data->ec_dev);
cros_ish_deinit(cros_ish_cl);
ishtp_put_device(cl_device);
}
--
2.51.2.997.g839fc31de9-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-10 6:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-31 3:39 [PATCH] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver Tzung-Bi Shih
2025-11-10 6:32 ` Tzung-Bi Shih
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox