Mathias Krause
fbf8d71742
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal ...
Calling irq_domain_remove() will lead to freeing the IRQ domain
prematurely. The domain is still referenced and will be attempted to get
used via rmi_free_function_list() -> rmi_unregister_function() ->
irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer.
With PaX's MEMORY_SANITIZE this will lead to an access fault when
attempting to dereference embedded pointers, as in Torsten's report that
was faulting on the 'domain->ops->unmap' test.
Fix this by releasing the IRQ domain only after all related IRQs have
been deactivated.
Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Link: https://lore.kernel.org/r/20240222142654.856566-1-minipli@grsecurity.net
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2024-03-07 15:29:52 -08:00
2023-08-18 06:08:58 +10:00
2023-08-21 12:48:52 +02:00
2023-08-04 15:25:01 +02:00
2023-08-02 17:01:12 +09:00
2023-06-29 11:00:17 -07:00
2023-08-11 20:36:02 +02:00
2023-08-19 17:31:46 +02:00
2023-07-20 11:26:56 -07:00
2023-08-02 10:49:57 +03:00
2023-06-29 08:09:31 -06:00
2023-06-15 13:42:16 +02:00
2023-08-12 02:36:28 +03:00
2023-08-22 15:25:18 -07:00
2023-06-30 09:37:26 -07:00
2023-06-23 10:29:02 +02:00
2023-08-04 15:17:29 +02:00
2023-08-07 19:41:48 +02:00
2023-08-08 16:07:01 +02:00
2023-08-18 16:47:02 +08:00
2023-07-28 13:16:54 -06:00
2023-06-26 07:54:23 -06:00
2023-08-07 00:01:41 +05:30
2023-08-23 10:22:49 +02:00
2023-06-26 15:09:18 -07:00
2023-06-24 14:03:46 +09:00
2023-07-20 13:31:58 +01:00
2023-07-03 12:46:47 -07:00
2023-08-23 21:05:28 +02:00
2023-08-25 09:12:02 +10:00
2023-07-12 11:56:22 -07:00
2023-06-28 17:53:25 +00:00
2023-08-09 21:09:47 -07:00
2023-06-14 08:15:24 -07:00
2023-07-03 12:46:47 -07:00
2023-08-14 18:17:13 +02:00
2023-07-19 20:10:03 +02:00
2023-07-29 12:21:21 +01:00
2023-08-10 16:35:54 -03:00
2024-03-07 15:29:52 -08:00
2023-07-11 15:44:43 +03:00
2023-07-27 11:27:20 -03:00
2023-07-30 10:59:19 -07:00
2023-08-03 18:08:32 -07:00
2023-08-22 11:02:29 -07:00
2023-06-21 14:08:54 +10:00
2023-06-30 17:35:45 -05:00
2023-07-25 11:55:50 -04:00
2023-08-24 19:10:53 -07:00
2023-07-25 22:09:20 +02:00
2023-06-12 15:16:19 +02:00
2023-07-03 10:55:04 -07:00
2023-08-04 15:52:51 +02:00
2023-08-15 13:24:29 +02:00
2023-07-27 16:54:23 +02:00
2023-06-15 13:42:18 +02:00
2023-08-24 10:07:13 +02:00
2023-06-22 18:40:38 -07:00
2023-07-08 13:55:44 -04:00
2023-06-26 07:54:23 -06:00
2023-08-11 12:14:08 -07:00
2023-06-15 13:42:18 +02:00
2023-08-21 16:12:28 -05:00
2023-06-27 07:35:14 +05:30
2023-08-10 22:22:03 +02:00
2023-08-03 14:40:37 +02:00
2023-08-11 09:39:17 -07:00
2023-06-15 13:42:18 +02:00
2023-07-12 07:41:23 -07:00
2023-07-24 16:23:37 +05:30
2023-08-21 12:28:28 +02:00
2023-08-23 17:13:36 +02:00
2023-07-03 17:23:16 -07:00
2023-08-01 13:45:08 +02:00
2023-07-03 13:17:25 -07:00
2023-07-05 12:55:06 -07:00
2023-08-07 15:13:27 +01:00
2023-07-03 17:03:05 -07:00
2023-06-29 15:22:19 -07:00
2023-07-03 10:43:10 -07:00
2023-08-03 14:00:02 -07:00
2023-06-23 10:27:02 +02:00
2023-08-27 07:33:54 -07:00
2023-08-12 12:12:58 +02:00
2023-07-13 11:09:07 +05:30
2023-08-21 13:09:57 +01:00
2023-07-30 11:47:56 -07:00
2023-07-08 12:35:18 -07:00
2023-06-29 15:22:19 -07:00
2023-08-01 13:45:08 +02:00
2023-08-04 16:17:47 +03:00
2023-08-11 21:19:22 +02:00
2023-08-21 17:32:55 -04:00
2023-08-04 14:57:23 +02:00
2023-08-10 15:51:46 -04:00
2023-06-30 15:22:09 -07:00
2023-08-10 15:24:28 -04:00
2023-08-15 23:39:33 +02:00
2023-06-27 16:46:06 -07:00
2023-08-10 15:51:46 -04:00
2023-06-26 14:30:07 +02:00
2023-07-27 07:53:12 +02:00
fbf8d71742