xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gpiolib: Fix possible use after free on label

Browse Source 
gpiod_request_commit() copies the pointer to the label passed as
an argument only to be used later. But there's a chance the caller
could immediately free the passed string(e.g., local variable).
This could trigger a use after free when we use gpio label(e.g.,
gpiochip_unlock_as_irq(), gpiochip_is_requested()).

To be on the safe side: duplicate the string with kstrdup_const()
so that if an unaware user passes an address to a stack-allocated
buffer, we won't get the arbitrary label.

Also fix gpiod_set_consumer_name().

Signed-off-by: Muchun Song <smuchun@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
This commit is contained in:
Muchun Song
2018-11-01 21:12:50 +08:00
committed by Linus Walleij
parent 02cb87f79b
commit 18534df419
2 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
include/linux/gpio/consumer.h
View File

@@ -162,7 +162,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc);
int gpiod_cansleep(const struct gpio_desc *desc);
int gpiod_to_irq(const struct gpio_desc *desc);
void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
/* Convert between the old gpio_ and new gpiod_ interfaces */
struct gpio_desc *gpio_to_desc(unsigned gpio);
@@ -495,10 +495,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
return -EINVAL;
}
static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
const char *name)
{
/* GPIO can never have been requested */
WARN_ON(1);
return -EINVAL;
}
static inline struct gpio_desc *gpio_to_desc(unsigned gpio)