diff options
| author | Ahmad Fatoum <ahmad@a3f.at> | 2021-09-13 10:29:57 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2021-10-04 12:46:31 +0200 |
| commit | ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85 (patch) | |
| tree | 97aa709cd3e6bd8da319ad3aca63a53dcead6ceb /include | |
| parent | 90583805dcd7745d2d3fbac5a95e70a3b11aaff2 (diff) | |
| download | barebox-ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85.tar.gz barebox-ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85.tar.xz | |
blspec: fix use-after-free of firmware search path
firmware_set_searchpath() is used to temporarily extend firmware search
path when parsing boot spec files. It does so by first freeing the
original firmware pointer and then storing a pointer to a copy of the
new search path.
firmware_get_searchpath() returns this pointer without copying meaning
that following sequence causes a use-after-free:
old_fws = firmware_get_searchpath();
firmware_set_searchpath(fws); /* calls free(old_fws) */
firmware_set_searchpath(old_fws);
Fix this by keeping around a copy of the search path.
Fixes: dfebbb0a5944 ("blspec: Set firmware searchpath")
Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Link: https://lore.barebox.org/20210913082957.364440-1-ahmad@a3f.at
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/firmware.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/firmware.h b/include/firmware.h index 0ffea52840..2583342230 100644 --- a/include/firmware.h +++ b/include/firmware.h @@ -31,7 +31,7 @@ struct firmware_mgr *firmwaremgr_find(const char *); #ifdef CONFIG_FIRMWARE struct firmware_mgr *firmwaremgr_find_by_node(struct device_node *np); int firmwaremgr_load_file(struct firmware_mgr *, const char *path); -const char *firmware_get_searchpath(void); +char *firmware_get_searchpath(void); void firmware_set_searchpath(const char *path); #else static inline struct firmware_mgr *firmwaremgr_find_by_node(struct device_node *np) @@ -44,7 +44,7 @@ static inline int firmwaremgr_load_file(struct firmware_mgr *mgr, const char *pa return -ENOSYS; } -static inline const char *firmware_get_searchpath(void) +static inline char *firmware_get_searchpath(void) { return NULL; } |