diff options
| author | Junrui Luo <moonafterrain@outlook.com> | 2025-12-10 17:48:08 +0800 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2025-12-14 09:35:43 -0800 |
| commit | 6946c726c3f4c36f0f049e6f97e88c510b15f65d (patch) | |
| tree | 6697cefa9284ff9661aa4ad78c1a0bfad233b99f /lib/memory-notifier-error-inject.c | |
| parent | 46c28bbbb150b80827e4bcbea231560af9d16854 (diff) | |
hwmon: (ibmpex) fix use-after-free in high/low store
The ibmpex_high_low_store() function retrieves driver data using
dev_get_drvdata() and uses it without validation. This creates a race
condition where the sysfs callback can be invoked after the data
structure is freed, leading to use-after-free.
Fix by adding a NULL check after dev_get_drvdata(), and reordering
operations in the deletion path to prevent TOCTOU.
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://lore.kernel.org/r/MEYPR01MB7886BE2F51BFE41875B74B60AFA0A@MEYPR01MB7886.ausprd01.prod.outlook.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'lib/memory-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions