Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-01 02:36:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

platform/loongarch: laptop: Fix possible UAF and simplify generic_acpi_laptop_init()

Browse Source 
Currently the return value of 'sub_driver->init' is not checked. If
sparse_keymap_setup() called in the init function fails, 'generic_
inputdev' is freed, then it will lead a UAF when using it in generic_
acpi_laptop_init(). Fix it by checking the return value and setting
generic_inputdev to NULL after free, so as to avoid double free it.

The error code in generic_subdriver_init() is always negative, so the
return of generic_subdriver_init() can be simplified.

Fixes: 6246ed0911 ("LoongArch: Add ACPI-based generic laptop driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
This commit is contained in:
Yang Yingliang 2022-10-29 16:29:31 +08:00 committed by Huacai Chen
parent fbe605ab15
commit d81916910f
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/platform/loongarch/loongson-laptop.c
View File

@ -448,6 +448,7 @@ static int __init event_init(struct generic_sub_driver *sub_driver)
if (ret < 0) {
pr_err("Failed to setup input device keymap\n");
input_free_device(generic_inputdev);
generic_inputdev = NULL;
return ret;
}
@ -502,8 +503,11 @@ static int __init generic_subdriver_init(struct generic_sub_driver *sub_driver)
if (ret)
return -EINVAL;
if (sub_driver->init)
sub_driver->init(sub_driver);
if (sub_driver->init) {
ret = sub_driver->init(sub_driver);
if (ret)
goto err_out;
}
if (sub_driver->notify) {
ret = setup_acpi_notify(sub_driver);
@ -519,7 +523,7 @@ static int __init generic_subdriver_init(struct generic_sub_driver *sub_driver)
err_out:
generic_subdriver_exit(sub_driver);
return (ret < 0) ? ret : 0;
return ret;
}
static void generic_subdriver_exit(struct generic_sub_driver *sub_driver)