* [PATCH] sh/intc: Add missing list_del(&d->list) in register_intc_controller
@ 2022-11-25 1:17 Gaosheng Cui
2022-12-03 5:13 ` Rob Landley
0 siblings, 1 reply; 2+ messages in thread
From: Gaosheng Cui @ 2022-11-25 1:17 UTC (permalink / raw)
To: ysato, dalias, cuigaosheng1, lethal, damm; +Cc: linux-sh
The list_del(&d->list) should be called in the error handling in
register_intc_controller(), otherwise, d will be freed, but d->list
will not be removed from &intc_list, list traversal may cause UAF.
Fix it by adding missing list_del(&d->list) in register_intc_controller.
Fixes: 2dcec7a988a1 ("sh: intc: set_irq_wake() support")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
---
drivers/sh/intc/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index ca4f4ca413f1..6bf38cd0f6e5 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -387,6 +387,7 @@ int __init register_intc_controller(struct intc_desc *desc)
kfree(d->window);
err1:
+ list_del(&d->list);
kfree(d);
err0:
pr_err("unable to allocate INTC memory\n");
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] sh/intc: Add missing list_del(&d->list) in register_intc_controller
2022-11-25 1:17 [PATCH] sh/intc: Add missing list_del(&d->list) in register_intc_controller Gaosheng Cui
@ 2022-12-03 5:13 ` Rob Landley
0 siblings, 0 replies; 2+ messages in thread
From: Rob Landley @ 2022-12-03 5:13 UTC (permalink / raw)
To: Gaosheng Cui, ysato, dalias, lethal, damm; +Cc: linux-sh
On 11/24/22 19:17, Gaosheng Cui wrote:
> The list_del(&d->list) should be called in the error handling in
> register_intc_controller(), otherwise, d will be freed, but d->list
> will not be removed from &intc_list, list traversal may cause UAF.
...
> Fix it by adding missing list_del(&d->list) in register_intc_controller.
>
> Fixes: 2dcec7a988a1 ("sh: intc: set_irq_wake() support")
> Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Acked-by: Rob Landley <rob@landley.net>
Looks right but I haven't got an obvious way to test this. (Do you have a test
case that triggers the error path?)
Rob
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-12-03 5:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-25 1:17 [PATCH] sh/intc: Add missing list_del(&d->list) in register_intc_controller Gaosheng Cui
2022-12-03 5:13 ` Rob Landley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).