Tzung-Bi Shih 393b8f9bed platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver ...

commit 944edca81e7aea15f83cf9a13a6ab67f711e8abd upstream.

After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.

The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously.  Fix it.

Fixes: 26a14267af ("platform/chrome: Add ChromeOS EC ISHTP driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-11 15:22:00 +01:00

..

wilco_ec

Merge tag 'driver-core-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2023-04-27 11:53:57 -07:00

chromeos_acpi.c

platform/chrome: chromeos_acpi: print hex string for ACPI_TYPE_BUFFER

2023-08-10 11:10:56 +08:00

chromeos_laptop.c

platform/chrome: fix double-free in chromeos_laptop_prepare()

2022-08-22 06:56:45 +00:00

chromeos_privacy_screen.c

ACPI: make remove callback of ACPI driver void

2022-11-23 19:11:22 +01:00

chromeos_pstore.c

Merge tag 'tag-chrome-platform-for-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

2020-06-04 10:54:45 -07:00

chromeos_tbmc.c

platform/chrome: chromeos_tbmc: Report wake events

2019-09-12 16:01:35 +02:00

cros_ec_chardev.c

platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

2023-03-24 10:56:28 +08:00

cros_ec_debugfs.c

platform/chrome: cros_ec_debugfs: fix wrong EC message version

2024-08-03 08:53:20 +02:00

cros_ec_i2c.c

platform/chrome: Switch i2c drivers back to use .probe()

2023-05-29 08:37:29 +08:00

cros_ec_ishtp.c

platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

2026-01-11 15:22:00 +01:00

cros_ec_lightbar.c

platform/chrome: use sysfs_emit() instead of scnprintf()

2022-12-26 11:14:34 +08:00

cros_ec_lpc_mec.c

platform/chrome: cros_ec_lpc: MEC access can use an AML mutex

2024-09-08 07:54:45 +02:00

cros_ec_lpc_mec.h

platform/chrome: cros_ec_lpc: MEC access can use an AML mutex

2024-09-08 07:54:45 +02:00

cros_ec_lpc.c

platform/chrome: cros_ec_lpc: Separate host command and irq disable

2023-11-20 11:59:08 +01:00

cros_ec_proto_test.c

platform/chrome: kunit: initialize lock for fake ec_dev

2023-11-28 17:19:39 +00:00

cros_ec_proto.c

platform/chrome: cros_ec_proto: Lock device when updating MKBP version

2024-08-11 12:47:24 +02:00

cros_ec_rpmsg.c

platform/chrome: correct cros_ec_prepare_tx() usage

2022-05-16 10:01:51 +08:00

cros_ec_sensorhub_ring.c

platform: chrome: Split trace include file

2022-03-31 16:56:29 -07:00

cros_ec_sensorhub_trace.h

platform: chrome: Split trace include file

2022-03-31 16:56:29 -07:00

cros_ec_sensorhub.c

platform/chrome: cros_ec_sensorhub: simplify getting .driver_data

2021-09-27 09:18:58 +02:00

cros_ec_spi.c

platform/chrome: cros_ec_spi: Use %*ph for printing hexdump of a small buffer

2023-06-13 12:28:36 +08:00

cros_ec_sysfs.c

platform/chrome: use sysfs_emit_at() instead of scnprintf()

2022-12-26 16:14:53 +08:00

cros_ec_trace.c

platform/chrome: cros_ec: Add command for regulator control.

2020-06-15 22:40:14 +01:00

cros_ec_trace.h

platform/chrome: use macros for passthru indexes

2022-06-10 02:31:42 +00:00

cros_ec_typec.c

platform/chrome: cros_ec_typec: Defer probe on missing EC parent

2025-08-28 16:28:19 +02:00

cros_ec_typec.h

platform/chrome: cros_ec_typec: Move structs to header

2023-01-09 20:32:53 +00:00

cros_ec_uart.c

platform/chrome: cros_ec_uart: properly fix race condition

2024-04-17 11:19:25 +02:00

cros_ec_vbc.c

platform/chrome: Constify static attribute_group structs

2021-01-20 16:19:17 +01:00

cros_ec.c

platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()

2025-08-28 16:28:32 +02:00

cros_ec.h

platform/chrome: cros_ec_lpc: Separate host command and irq disable

2023-11-20 11:59:08 +01:00

cros_hps_i2c.c

platform/chrome: Switch i2c drivers back to use .probe()

2023-05-29 08:37:29 +08:00

cros_kbd_led_backlight.c

platform/chrome: cros_kbd_led_backlight: fix build warning

2022-07-20 01:22:59 +00:00

cros_kunit_util.c

platform/chrome: cros_kunit_util: add default value for msg->result

2022-07-21 08:49:28 +00:00

cros_kunit_util.h

platform/chrome: cros_kunit_util: add default value for msg->result

2022-07-21 08:49:28 +00:00

cros_typec_switch.c

platform/chrome: cros_typec_switch: Add Pin D support

2023-05-11 21:17:53 +00:00

cros_typec_vdm.c

platform/chrome: cros_typec_vdm: Add Attention support

2023-01-31 18:12:18 +00:00

cros_typec_vdm.h

platform/chrome: cros_typec_vdm: Add Attention support

2023-01-31 18:12:18 +00:00

cros_usbpd_logger.c

platform/chrome: cros_usbpd_logger: Add __printf annotation to append_str()

2020-05-04 14:02:01 -07:00

cros_usbpd_notify.c

platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()

2022-11-25 08:28:28 +00:00

Kconfig

platform/chrome: cros_ec_typec: Alter module name with hyphens

2023-01-09 20:32:53 +00:00

Makefile

platform/chrome: cros_ec_typec: Add initial VDM support

2023-01-09 20:32:53 +00:00