• Muchun Song's avatar
    gpiolib: Fix possible use after free on label · 4672971c
    Muchun Song authored
    [ Upstream commit 18534df4 ]
    
    gpiod_request_commit() copies the pointer to the label passed as
    an argument only to be used later. But there's a chance the caller
    could immediately free the passed string(e.g., local variable).
    This could trigger a use after free when we use gpio label(e.g.,
    gpiochip_unlock_as_irq(), gpiochip_is_requested()).
    
    To be on the safe side: duplicate the string with kstrdup_const()
    so that if an unaware user passes an address to a stack-allocated
    buffer, we won't get the arbitrary label.
    
    Also fix gpiod_set_consumer_name().
    Signed-off-by: 's avatarMuchun Song <smuchun@gmail.com>
    Signed-off-by: 's avatarLinus Walleij <linus.walleij@linaro.org>
    Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
    4672971c
Name
Last commit
Last update
..
acpi Loading commit data...
asm-generic Loading commit data...
clocksource Loading commit data...
crypto Loading commit data...
drm Loading commit data...
dt-bindings Loading commit data...
keys Loading commit data...
kvm Loading commit data...
linux Loading commit data...
math-emu Loading commit data...
media Loading commit data...
memory Loading commit data...
misc Loading commit data...
net Loading commit data...
pcmcia Loading commit data...
ras Loading commit data...
rdma Loading commit data...
scsi Loading commit data...
soc Loading commit data...
sound Loading commit data...
target Loading commit data...
trace Loading commit data...
uapi Loading commit data...
video Loading commit data...
xen Loading commit data...