Carlo SzelinskyandJonas Jelonek
d060557066
pse_isr() 32-bit OOB bitmap access, disable IRQ before freeing PI data on unregister, and guard against freed PI data on regulator disable. Pending upstream in the PSE-core teardown UAF fix series [PATCH net v2 0/2] (in review; merge expected soon). Link: https://lore.kernel.org/all/20260711121611.1639086-1-github@szelinsky.de/ Signed-off-by: Carlo Szelinsky <github@szelinsky.de> Link: https://github.com/openwrt/openwrt/pull/22245 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
43 lines
1.5 KiB
Diff
43 lines
1.5 KiB
Diff
From: Corey Leavitt <corey@leavitt.info>
|
|
|
|
Hook the newly-introduced pse_controller_notifier chain so that
|
|
pse_controller_register() fires PSE_REGISTERED after the controller
|
|
has been added to pse_controller_list (i.e. is now resolvable by
|
|
of_pse_control_get()), and pse_controller_unregister() fires
|
|
PSE_UNREGISTERED before the controller is removed from the list
|
|
(while it is still valid to dereference from a subscriber's
|
|
pse_control pointer targeting it).
|
|
|
|
With no subscribers yet, this is observably a no-op. A later change
|
|
wires the phy subsystem in as the first subscriber.
|
|
|
|
Signed-off-by: Corey Leavitt <corey@leavitt.info>
|
|
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
|
|
Tested-by: Jonas Jelonek <jelonek.jonas@gmail.com>
|
|
---
|
|
drivers/net/pse-pd/pse_core.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
--- a/drivers/net/pse-pd/pse_core.c
|
|
+++ b/drivers/net/pse-pd/pse_core.c
|
|
@@ -1145,6 +1145,9 @@ int pse_controller_register(struct pse_c
|
|
list_add(&pcdev->list, &pse_controller_list);
|
|
mutex_unlock(&pse_list_mutex);
|
|
|
|
+ blocking_notifier_call_chain(&pse_controller_notifier,
|
|
+ PSE_REGISTERED, pcdev);
|
|
+
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(pse_controller_register);
|
|
@@ -1155,6 +1158,9 @@ EXPORT_SYMBOL_GPL(pse_controller_registe
|
|
*/
|
|
void pse_controller_unregister(struct pse_controller_dev *pcdev)
|
|
{
|
|
+ blocking_notifier_call_chain(&pse_controller_notifier,
|
|
+ PSE_UNREGISTERED, pcdev);
|
|
+
|
|
pse_flush_pw_ds(pcdev);
|
|
if (pcdev->irq)
|
|
disable_irq(pcdev->irq);
|