]> rtime.felk.cvut.cz Git - sojka/nv-tegra/linux-3.10.git/commit
Fix firmware loader uevent buffer NULL pointer dereference
authorLinus Torvalds <torvalds@linux-foundation.org>
Thu, 9 Jul 2015 18:20:01 +0000 (11:20 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 3 Aug 2015 16:29:47 +0000 (09:29 -0700)
commit27dbfee9cffffa812e56f8a1a2f84f91d1d9ad63
tree4bacd96eece92f0faad93739331746f297ca7fbc
parentc0e05f1c65358e9b770cebaf05200bb6243c28e5
Fix firmware loader uevent buffer NULL pointer dereference

commit 6f957724b94cb19f5c1c97efd01dd4df8ced323c upstream.

The firmware class uevent function accessed the "fw_priv->buf" buffer
without the proper locking and testing for NULL.  This is an old bug
(looks like it goes back to 2012 and commit 1244691c73b2: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering
only now in 4.2-rc1.

Shuah Khan is trying to bisect what it is that causes this to trigger
more easily, but in the meantime let's just fix the bug since others are
hitting it too (at least Ingo reports having seen it as well).

Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/base/firmware_class.c