firmware loader: fix use-after-free by double abort
authorMing Lei <ming.lei@canonical.com>
Sat, 15 Jun 2013 08:36:38 +0000 (16:36 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Jun 2013 17:39:09 +0000 (10:39 -0700)
commitbbf322be24a8e42b7d7fb88db9503ec65845b3a5
treed6939974216df8b93a2c938e1ced8da66dd4e32e
parenta8608da733091cd11c8efcf35341a04c43b96966
firmware loader: fix use-after-free by double abort

commit 875979368eb4cfecff9f0e97625b90cc6009269d upstream.

fw_priv->buf is accessed in both request_firmware_load() and
writing to sysfs file of 'loading' context, but not protected
by 'fw_lock' entirely. The patch makes sure that access on
'fw_priv->buf' is protected by the lock.

So fixes the double abort problem reported by nirinA raseliarison:

http://lkml.org/lkml/2013/6/14/188

Reported-and-tested-by: nirinA raseliarison <nirina.raseliarison@gmail.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/base/firmware_class.c