From: Sasha Levin <sashal@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
Subject: Re: [PATCH AUTOSEL 5.1 06/60] driver core: platform: Fix the usage of platform device name(pdev->name)
Date: Sat, 15 Jun 2019 18:26:27 -0400 [thread overview]
Message-ID: <20190615222626.GR1513@sasha-vm> (raw)
In-Reply-To: <20190605045846.GA21363@kroah.com>
On Wed, Jun 05, 2019 at 06:58:46AM +0200, Greg Kroah-Hartman wrote:
>On Tue, Jun 04, 2019 at 07:21:16PM -0400, Sasha Levin wrote:
>> From: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
>>
>> [ Upstream commit edb16da34b084c66763f29bee42b4e6bb33c3d66 ]
>>
>> Platform core is using pdev->name as the platform device name to do
>> the binding of the devices with the drivers. But, when the platform
>> driver overrides the platform device name with dev_set_name(),
>> the pdev->name is pointing to a location which is freed and becomes
>> an invalid parameter to do the binding match.
>>
>> use-after-free instance:
>>
>> [ 33.325013] BUG: KASAN: use-after-free in strcmp+0x8c/0xb0
>> [ 33.330646] Read of size 1 at addr ffffffc10beae600 by task modprobe
>> [ 33.339068] CPU: 5 PID: 518 Comm: modprobe Tainted:
>> G S W O 4.19.30+ #3
>> [ 33.346835] Hardware name: MTP (DT)
>> [ 33.350419] Call trace:
>> [ 33.352941] dump_backtrace+0x0/0x3b8
>> [ 33.356713] show_stack+0x24/0x30
>> [ 33.360119] dump_stack+0x160/0x1d8
>> [ 33.363709] print_address_description+0x84/0x2e0
>> [ 33.368549] kasan_report+0x26c/0x2d0
>> [ 33.372322] __asan_report_load1_noabort+0x2c/0x38
>> [ 33.377248] strcmp+0x8c/0xb0
>> [ 33.380306] platform_match+0x70/0x1f8
>> [ 33.384168] __driver_attach+0x78/0x3a0
>> [ 33.388111] bus_for_each_dev+0x13c/0x1b8
>> [ 33.392237] driver_attach+0x4c/0x58
>> [ 33.395910] bus_add_driver+0x350/0x560
>> [ 33.399854] driver_register+0x23c/0x328
>> [ 33.403886] __platform_driver_register+0xd0/0xe0
>>
>> So, use dev_name(&pdev->dev), which fetches the platform device name from
>> the kobject(dev->kobj->name) of the device instead of the pdev->name.
>>
>> Signed-off-by: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> drivers/base/platform.c | 8 ++++----
>> 1 file changed, 4 insertions(+), 4 deletions(-)
>
>Please drop this from everywhere as it was reverted from Linus's tree
>because it causes big problems.
Dropped from all branches, thanks!
--
Thanks,
Sasha
next prev parent reply other threads:[~2019-06-15 22:26 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-04 23:21 [PATCH AUTOSEL 5.1 01/60] x86/uaccess, kcov: Disable stack protector Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 02/60] ALSA: seq: Protect in-kernel ioctl calls with mutex Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 03/60] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 04/60] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex" Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 05/60] ALSA: seq: Cover unsubscribe_port() in list_mutex Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 06/60] driver core: platform: Fix the usage of platform device name(pdev->name) Sasha Levin
2019-06-05 4:58 ` Greg Kroah-Hartman
2019-06-15 22:26 ` Sasha Levin [this message]
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 07/60] Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 08/60] configfs: fix possible use-after-free in configfs_register_group Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 09/60] f2fs: fix to avoid accessing xattr across the boundary Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 10/60] ipc: prevent lockup on alloc_msg and free_msg Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 11/60] drivers/perf: arm_spe: Don't error on high-order pages for aux buf Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 12/60] bpf: sockmap, only stop/flush strp if it was enabled at some point Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 13/60] bpf: sockmap remove duplicate queue free Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 14/60] bpf: sockmap fix msg->sg.size account on ingress skb Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 15/60] scsi: qla2xxx: Add cleanup for PCI EEH recovery Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 16/60] scsi: qedi: remove memset/memcpy to nfunc and use func instead Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 17/60] scsi: qedi: remove set but not used variables 'cdev' and 'udev' Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 18/60] scsi: lpfc: resolve lockdep warnings Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 19/60] scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 20/60] scsi: lpfc: add check for loss of ndlp when sending RRQ Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 21/60] arm64: Print physical address of page table base in show_pte() Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 22/60] net: macb: fix error format in dev_err() Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 23/60] enetc: Fix NULL dma address unmap for Tx BD extensions Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 24/60] bpf, tcp: correctly handle DONT_WAIT flags and timeo == 0 Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 25/60] arm64/mm: Inhibit huge-vmap with ptdump Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 26/60] tools/bpftool: move set_max_rlimit() before __bpf_object__open_xattr() Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 27/60] selftests/bpf: fix bpf_get_current_task Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 28/60] nvme-pci: Fix controller freeze wait disabling Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 29/60] nvme: fix srcu locking on error return in nvme_get_ns_from_disk Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 30/60] nvme: remove the ifdef around nvme_nvm_ioctl Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 31/60] nvme: merge nvme_ns_ioctl into nvme_ioctl Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 32/60] nvme: release namespace SRCU protection before performing controller ioctls Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 33/60] nvme: fix memory leak for power latency tolerance Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 34/60] platform/x86: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI table Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 35/60] platform/x86: pmc_atom: Add several Beckhoff Automation boards " Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 36/60] scsi: myrs: Fix uninitialized variable Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 37/60] scsi: bnx2fc: fix incorrect cast to u64 on shift operation Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 38/60] drm/amdgpu: keep stolen memory on picasso Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 39/60] libnvdimm: Fix compilation warnings with W=1 Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 40/60] selftests: fib_rule_tests: fix local IPv4 address typo Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190615222626.GR1513@sasha-vm \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vnkgutta@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).