diff options
| author | Gui-Dong Han <hanguidong02@gmail.com> | 2026-02-13 11:12:19 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-19 16:29:52 +0100 |
| commit | dd8ba8c0c3f3916d4ee1e3a09da9cd5caff5d227 (patch) | |
| tree | 2c1fbfe0dfc402298a2cc0dee0e906e3689d7d00 /include/net/aligned_data.h | |
| parent | b7a5b454b7f7a85a07fc047f3b0dbc672e55561f (diff) | |
bus: fsl-mc: fix use-after-free in driver_override_show()
[ Upstream commit 148891e95014b5dc5878acefa57f1940c281c431 ]
The driver_override_show() function reads the driver_override string
without holding the device_lock. However, driver_override_store() uses
driver_set_override(), which modifies and frees the string while holding
the device_lock.
This can result in a concurrent use-after-free if the string is freed
by the store function while being read by the show function.
Fix this by holding the device_lock around the read operation.
Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/net/aligned_data.h')
0 files changed, 0 insertions, 0 deletions