mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-29 10:58:23 +00:00
7272b591c4
In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(), to avoid the uaf bugs. Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| command.c | ||
| dot_command.c | ||
| dot_command.h | ||
| event.c | ||
| heartbeat.c | ||
| i2o.h | ||
| ibmasm.h | ||
| ibmasmfs.c | ||
| lowlevel.c | ||
| lowlevel.h | ||
| Makefile | ||
| module.c | ||
| r_heartbeat.c | ||
| remote.c | ||
| remote.h | ||
| uart.c | ||