Anirudh Rayabharam ecb739cf15 firmware_loader: fix use-after-free in firmware_fallback_sysfs ... commit 75d95e2e39 upstream. This use-after-free happens when a fw_priv object has been freed but hasn't been removed from the pending list (pending_fw_head). The next time fw_load_sysfs_fallback tries to insert into the list, it ends up accessing the pending_list member of the previously freed fw_priv. The root cause here is that all code paths that abort the fw load don't delete it from the pending list. For example: _request_firmware() -> fw_abort_batch_reqs() -> fw_state_aborted() To fix this, delete the fw_priv from the list in __fw_set_state() if the new state is DONE or ABORTED. This way, all aborts will remove the fw_priv from the list. Accordingly, remove calls to list_del_init that were being made before calling fw_state_(aborted|done). Also, in fw_load_sysfs_fallback, don't add the fw_priv to the pending list if it is already aborted. Instead, just jump out and return early. Fixes: bcfbd3523f ("firmware: fix a double abort case with fw_load_sysfs_fallback") Cc: stable <stable@vger.kernel.org> Reported-by: syzbot+de271708674e2093097b@syzkaller.appspotmail.com Tested-by: syzbot+de271708674e2093097b@syzkaller.appspotmail.com Reviewed-by: Shuah Khan <skhan@linuxfoundation.org> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com> Link: https://lore.kernel.org/r/20210728085107.4141-3-mail@anirudhrb.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-08-12 13:22:09 +02:00
..
builtin	Fix built-in early-load Intel microcode alignment	2020-01-15 11:50:37 -08:00
fallback_platform.c	firmware: Store opt_flags in fw_priv	2020-10-05 13:37:04 +02:00
fallback_table.c	firmware_loader: move fw_fallback_config to a private kernel symbol namespace	2020-04-28 21:05:42 +02:00
fallback.c	firmware_loader: fix use-after-free in firmware_fallback_sysfs	2021-08-12 13:22:09 +02:00
fallback.h	firmware: Store opt_flags in fw_priv	2020-10-05 13:37:04 +02:00
firmware.h	firmware_loader: fix use-after-free in firmware_fallback_sysfs	2021-08-12 13:22:09 +02:00
Kconfig	drivers: base: Fix Kconfig indentation	2019-11-20 15:10:25 +01:00
main.c	firmware_loader: fix use-after-free in firmware_fallback_sysfs	2021-08-12 13:22:09 +02:00
Makefile	firmware: Add new platform fallback mechanism and firmware_request_platform()	2020-03-20 14:54:04 +01:00