[ciqlts8 6] CVE-2022-50087#778
Merged
Merged
Conversation
jira VULN-70082 cve CVE-2022-50087 commit-author Sudeep Holla <sudeep.holla@arm.com> commit 689640e upstream-diff | Adjusted context in the scpi_probe func due to missing commit 43b9ac9 ("firmware: arm_scpi: convert platform driver to use dev_groups") When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it is not taken care, then it could result use-after-free as the value is exported via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc() but freed when the probe fails. Link: https://lore.kernel.org/r/20220701160310.148344-1-sudeep.holla@arm.com Cc: stable@vger.kernel.org # 4.19+ Reported-by: huhai <huhai@kylinos.cn> Reviewed-by: Jackie Liu <liuyun01@kylinos.cn> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> (cherry picked from commit 689640e) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
🔍 Interdiff Analysis
diff -u b/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
--- b/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -1023,10 +1027,11 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
FIELD_GET(FW_REV_MINOR_MASK,
scpi_info->firmware_version),
FIELD_GET(FW_REV_PATCH_MASK,
- scpi_info->firmware_version));
- scpi_info->scpi_ops = &scpi_ops;
+ scpi_drvinfo->firmware_version));
+
+ scpi_drvinfo->scpi_ops = &scpi_ops;
ret = devm_device_add_groups(dev, versions_groups);
if (ret)
dev_err(dev, "unable to create sysfs version group\n");
@@ -1026,6 +1026,10 @@
scpi_info->firmware_version));
scpi_info->scpi_ops = &scpi_ops;
+ ret = devm_device_add_groups(dev, versions_groups);
+ if (ret)
+ dev_err(dev, "unable to create sysfs version group\n");
+
return devm_of_platform_populate(dev);
}
@@ -1030,7 +1035,11 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
if (ret)
dev_err(dev, "unable to create sysfs version group\n");
- return devm_of_platform_populate(dev);
+ ret = devm_of_platform_populate(dev);
+ if (ret)
+ scpi_info = NULL;
+
+ return ret;
}
static const struct of_device_id scpi_of_match[] = {This is an automated interdiff check for backported commits. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DESCRIPTION
Not a clean cherry pick due to missing
\43b9ac937be6f ("firmware: arm_scpi: convert platform driver to use dev_groups")
Part of a bigger patchset and requires this commit torvalds/linux@23b6904
COMMITS
TESTING
BUILD
Kselftests
Check_kernel_commits
Run interdiff
Check colordiff instead
That's due to missing commit
43b9ac9 ("firmware: arm_scpi: convert platform driver to use dev_groups")
Part of a bigger patchset and requires this commit torvalds/linux@23b6904
colordiff.log
Run jira_pr_check