| Message ID | 20250107123510.44978-1-dheeraj.linuxdev@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [iio-next] iio: proximity: Fix use-after-free in hx9023s_send_cfg() | expand |
On 1/7/25 6:35 AM, Dheeraj Reddy Jonnalagadda wrote: > Reorder the assignment of fw_size to happen before release_firmware() > to avoid accessing the firmware structure after it's been freed. > > Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality") > Closes: https://scan7.scan.coverity.com/#/project-view/52337/11354?selectedIssue=1602791 > Signed-off-by: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com> > --- Reviewed-by: David Lechner <dlechner@baylibre.com>
diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c index e092a935dbac..5aa8e5a22f32 100644 --- a/drivers/iio/proximity/hx9023s.c +++ b/drivers/iio/proximity/hx9023s.c @@ -1036,12 +1036,13 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data return -ENOMEM; memcpy(bin->data, fw->data, fw->size); - release_firmware(fw); bin->fw_size = fw->size; bin->fw_ver = bin->data[FW_VER_OFFSET]; bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET); + release_firmware(fw); + return hx9023s_bin_load(data, bin); }
Reorder the assignment of fw_size to happen before release_firmware() to avoid accessing the firmware structure after it's been freed. Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality") Closes: https://scan7.scan.coverity.com/#/project-view/52337/11354?selectedIssue=1602791 Signed-off-by: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com> --- drivers/iio/proximity/hx9023s.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)