Patch "Fix firmware loader uevent buffer NULL pointer dereference" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

Fix firmware loader uevent buffer NULL pointer dereference

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
fix-firmware-loader-uevent-buffer-null-pointer-dereference.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Linus Torvalds <[email protected]>
Date: Thu, 9 Jul 2015 11:20:01 -0700
Subject: Fix firmware loader uevent buffer NULL pointer dereference

From: Linus Torvalds <[email protected]>

commit 6f957724b94cb19f5c1c97efd01dd4df8ced323c upstream.

The firmware class uevent function accessed the "fw_priv->buf" buffer without the proper locking and testing for NULL. This is an old bug (looks like it goes back to 2012 and commit 1244691c73b2: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering only now in 4.2-rc1.

Shuah Khan is trying to bisect what it is that causes this to trigger more easily, but in the meantime let's just fix the bug since others are hitting it too (at least Ingo reports having seen it as well).

---
 drivers/base/firmware_class.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

@@ -544,10 +544,8 @@ static void fw_dev_release(struct device
 	kfree(fw_priv);
 }
 
-static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
 {
-	struct firmware_priv *fw_priv = to_firmware_priv(dev);
-
 	if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
 		return -ENOMEM;
 	if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))

@@ -558,6 +556,18 @@ static int firmware_uevent(struct device
 	return 0;
 }
 
+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+	struct firmware_priv *fw_priv = to_firmware_priv(dev);
+	int err = 0;
+
+	mutex_lock(&fw_lock);
+	if (fw_priv->buf)
+		err = do_firmware_uevent(fw_priv, env);
+	mutex_unlock(&fw_lock);
+	return err;
+}
+
 static struct class firmware_class = {
 	.name		= "firmware",
 	.class_attrs	= firmware_class_attrs,

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/fix-firmware-loader-uevent-buffer-null-pointer-dereference.patch queue-4.1/security_syslog-should-be-called-once-only.patch queue-4.1/hpfs-kstrdup-out-of-memory-handling.patch queue-4.1/compiler-intel-fix-wrong-compiler-barrier-macro.patch queue-4.1/mm-hugetlb-introduce-minimum-hugepage-order.patch queue-4.1/hpfs-hpfs_error-remove-static-buffer-use-vsprintf-extension-pv-instead.patch queue-4.1/__bitmap_parselist-fix-bug-in-empty-string-handling.patch queue-4.1/openrisc-fix-config_uid16-setting.patch