diff options
| author | Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org> | 2019-04-22 17:16:29 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-04-25 22:22:12 +0200 |
| commit | edb16da34b084c66763f29bee42b4e6bb33c3d66 (patch) | |
| tree | ac39dd6cc6b6f36d64668c5b65d1f01ddfcab179 /drivers/base | |
| parent | 70283454c918f1d65de0ec50c45ef592d781bcae (diff) | |
| download | linux-edb16da34b084c66763f29bee42b4e6bb33c3d66.tar.bz2 | |
driver core: platform: Fix the usage of platform device name(pdev->name)
Platform core is using pdev->name as the platform device name to do
the binding of the devices with the drivers. But, when the platform
driver overrides the platform device name with dev_set_name(),
the pdev->name is pointing to a location which is freed and becomes
an invalid parameter to do the binding match.
use-after-free instance:
[ 33.325013] BUG: KASAN: use-after-free in strcmp+0x8c/0xb0
[ 33.330646] Read of size 1 at addr ffffffc10beae600 by task modprobe
[ 33.339068] CPU: 5 PID: 518 Comm: modprobe Tainted:
G S W O 4.19.30+ #3
[ 33.346835] Hardware name: MTP (DT)
[ 33.350419] Call trace:
[ 33.352941] dump_backtrace+0x0/0x3b8
[ 33.356713] show_stack+0x24/0x30
[ 33.360119] dump_stack+0x160/0x1d8
[ 33.363709] print_address_description+0x84/0x2e0
[ 33.368549] kasan_report+0x26c/0x2d0
[ 33.372322] __asan_report_load1_noabort+0x2c/0x38
[ 33.377248] strcmp+0x8c/0xb0
[ 33.380306] platform_match+0x70/0x1f8
[ 33.384168] __driver_attach+0x78/0x3a0
[ 33.388111] bus_for_each_dev+0x13c/0x1b8
[ 33.392237] driver_attach+0x4c/0x58
[ 33.395910] bus_add_driver+0x350/0x560
[ 33.399854] driver_register+0x23c/0x328
[ 33.403886] __platform_driver_register+0xd0/0xe0
So, use dev_name(&pdev->dev), which fetches the platform device name from
the kobject(dev->kobj->name) of the device instead of the pdev->name.
Signed-off-by: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/base')
| -rw-r--r-- | drivers/base/platform.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 4d1729853d1a..df76e40c1a83 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -890,7 +890,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a, if (len != -ENODEV) return len; - len = snprintf(buf, PAGE_SIZE, "platform:%s\n", pdev->name); + len = snprintf(buf, PAGE_SIZE, "platform:%s\n", dev_name(&pdev->dev)); return (len >= PAGE_SIZE) ? (PAGE_SIZE - 1) : len; } @@ -966,7 +966,7 @@ static int platform_uevent(struct device *dev, struct kobj_uevent_env *env) return rc; add_uevent_var(env, "MODALIAS=%s%s", PLATFORM_MODULE_PREFIX, - pdev->name); + dev_name(&pdev->dev)); return 0; } @@ -975,7 +975,7 @@ static const struct platform_device_id *platform_match_id( struct platform_device *pdev) { while (id->name[0]) { - if (strcmp(pdev->name, id->name) == 0) { + if (strcmp(dev_name(&pdev->dev), id->name) == 0) { pdev->id_entry = id; return id; } @@ -1019,7 +1019,7 @@ static int platform_match(struct device *dev, struct device_driver *drv) return platform_match_id(pdrv->id_table, pdev) != NULL; /* fall-back to driver name match */ - return (strcmp(pdev->name, drv->name) == 0); + return (strcmp(dev_name(&pdev->dev), drv->name) == 0); } #ifdef CONFIG_PM_SLEEP |