driver: base: fix UAF when driver_attach failed
PATCH v2 1/1 driver: base: fix UAF when driver_attach failed
When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF.
To fix it, we need to delete it from the bus when failed.
Fixes 190888ac01d0 ("driver core: fix possible missing of device probe")
Signed-off-by Schspa Shi <[email protected]>
---
Changelog:
v1 -> v2:
- Remove the blank line needed after fixes
--- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/bus.c +3 -1
@@ -617,7 +617,7 @@ int bus_add_driver(struct device_driver *drv)if (drv->bus->p->drivers_autoprobe) { error =driver_attach (drv);if (error) - goto out_unregister; + goto out_del_list; }module_add_driver (drv->owner, drv);
@@ -644,6 +644,8 @@ int bus_add_driver(struct device_driver *drv)return 0 ; +out_del_list: +klist_del (&priv->knode_bus); out_unregister:kobject_put (&priv->kobj);/* drv->p is freed in driver_release() */
Signature · 1 line
2.29.0