• Venkata Narendra Kumar Gutta's avatar
    driver core: platform: Fix the usage of platform device name(pdev->name) · edb16da3
    Venkata Narendra Kumar Gutta authored
    Platform core is using pdev->name as the platform device name to do
    the binding of the devices with the drivers. But, when the platform
    driver overrides the platform device name with dev_set_name(),
    the pdev->name is pointing to a location which is freed and becomes
    an invalid parameter to do the binding match.
    
    use-after-free instance:
    
    [   33.325013] BUG: KASAN: use-after-free in strcmp+0x8c/0xb0
    [   33.330646] Read of size 1 at addr ffffffc10beae600 by task modprobe
    [   33.339068] CPU: 5 PID: 518 Comm: modprobe Tainted:
    			G S      W  O      4.19.30+ #3
    [   33.346835] Hardware name: MTP (DT)
    [   33.350419] Call trace:
    [   33.352941]  dump_backtrace+0x0/0x3b8
    [   33.356713]  show_stack+0x24/0x30
    [   33.360119]  dump_stack+0x160/0x1d8
    [   33.363709]  print_address_description+0x84/0x2e0
    [   33.368549]  kasan_report+0x26c/0x2d0
    [   33.372322]  __asan_report_load1_noabort+0x2c/0x38
    [   33.377248]  strcmp+0x8c/0xb0
    [   33.380306]  platform_match+0x70/0x1f8
    [   33.384168]  __driver_attach+0x78/0x3a0
    [   33.388111]  bus_for_each_dev+0x13c/0x1b8
    [   33.392237]  driver_attach+0x4c/0x58
    [   33.395910]  bus_add_driver+0x350/0x560
    [   33.399854]  driver_register+0x23c/0x328
    [   33.403886]  __platform_driver_register+0xd0/0xe0
    
    So, use dev_name(&pdev->dev), which fetches the platform device name from
    the kobject(dev->kobj->name) of the device instead of the pdev->name.
    Signed-off-by: default avatarVenkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    edb16da3
platform.c 37.5 KB