• Sven Van Asbroeck's avatar
    dmaengine: imx-sdma: fix use-after-free on probe error path · 2b8066c3
    Sven Van Asbroeck authored
    If probe() fails anywhere beyond the point where
    sdma_get_firmware() is called, then a kernel oops may occur.
    
    Problematic sequence of events:
    1. probe() calls sdma_get_firmware(), which schedules the
       firmware callback to run when firmware becomes available,
       using the sdma instance structure as the context
    2. probe() encounters an error, which deallocates the
       sdma instance structure
    3. firmware becomes available, firmware callback is
       called with deallocated sdma instance structure
    4. use after free - kernel oops !
    
    Solution: only attempt to load firmware when we're certain
    that probe() will succeed. This guarantees that the firmware
    callback's context will remain valid.
    
    Note that the remove() path is unaffected by this issue: the
    firmware loader will increment the driver module's use count,
    ensuring that the module cannot be unloaded while the
    firmware callback is pending or running.
    Signed-off-by: default avatarSven Van Asbroeck <TheSven73@gmail.com>
    Reviewed-by: default avatarRobin Gong <yibin.gong@nxp.com>
    [vkoul: fixed braces for if condition]
    Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
    2b8066c3
imx-sdma.c 58.2 KB