Re: [PATCH AUTOSEL 5.0 070/317] driver core: platform: Fix the usage of platform device name(pdev->name)

Sasha Levin
2019-05-29T18:57:04Z

On Wed, May 22, 2019 at 10:04:52PM +0200, Greg Kroah-Hartman wrote:
>On Wed, May 22, 2019 at 03:19:31PM -0400, Sasha Levin wrote:
>> From: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
>>
>> [ Upstream commit edb16da34b084c66763f29bee42b4e6bb33c3d66 ]
>>
>> Platform core is using pdev->name as the platform device name to do
>> the binding of the devices with the drivers. But, when the platform
>> driver overrides the platform device name with dev_set_name(),
>> the pdev->name is pointing to a location which is freed and becomes
>> an invalid parameter to do the binding match.
>>
>> use-after-free instance:
>>
>> [ 33.325013] BUG: KASAN: use-after-free in strcmp+0x8c/0xb0
>> [ 33.330646] Read of size 1 at addr ffffffc10beae600 by task modprobe
>> [ 33.339068] CPU: 5 PID: 518 Comm: modprobe Tainted:
>> G S W O 4.19.30+ #3
>> [ 33.346835] Hardware name: MTP (DT)
>> [ 33.350419] Call trace:
>> [ 33.352941] dump_backtrace+0x0/0x3b8
>> [ 33.356713] show_stack+0x24/0x30
>> [ 33.360119] dump_stack+0x160/0x1d8
>> [ 33.363709] print_address_description+0x84/0x2e0
>> [ 33.368549] kasan_report+0x26c/0x2d0
>> [ 33.372322] __asan_report_load1_noabort+0x2c/0x38
>> [ 33.377248] strcmp+0x8c/0xb0
>> [ 33.380306] platform_match+0x70/0x1f8
>> [ 33.384168] __driver_attach+0x78/0x3a0
>> [ 33.388111] bus_for_each_dev+0x13c/0x1b8
>> [ 33.392237] driver_attach+0x4c/0x58
>> [ 33.395910] bus_add_driver+0x350/0x560
>> [ 33.399854] driver_register+0x23c/0x328
>> [ 33.403886] __platform_driver_register+0xd0/0xe0
>>
>> So, use dev_name(&pdev->dev), which fetches the platform device name from
>> the kobject(dev->kobj->name) of the device instead of the pdev->name.
>>
>> Signed-off-by: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> drivers/base/platform.c | 8 ++++----
>> 1 file changed, 4 insertions(+), 4 deletions(-)
>
>This patch was broken and got reverted in commit 391c0325cc5f ("Revert
>"driver core: platform: Fix the usage of platform device
>name(pdev->name)"") so please do not include it here, or anywhere.

Dropped everywhere, thanks!

--
Thanks,
Sasha