In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
power: supply: charger-manager: register regulators before exposing sysfs<\/p>\n
charger_manager_remove() and the err_reg_extcon probe error path free each
\ncharger regulator with regulator_put() before tearing down the power_supply
\nsysfs entries (power_supply_unregister()). charger_manager_remove() also
\ncalls try_charger_enable(cm, false) after the regulator_put() loop. A
\nconcurrent write to a charger’s externally_control sysfs attribute that
\nlands between regulator_put() and power_supply_unregister() can run
\ncharger_externally_control_store() and call try_charger_enable(), which,
\nwhen charging is enabled, dereferences the already-freed consumer handle.
\nWhen charging is enabled, try_charger_enable(cm, false) in .remove() also
\ndereferences the freed handles directly. Both leave use-after-free windows.
\nSymmetrically, probe registers the sysfs entries (power_supply_register)
\nbefore acquiring the regulators (regulator_get, inside
\ncharger_manager_register_extcon), so userspace can reach externally_control
\nbefore the regulators are available.<\/p>\n
Split charger_manager_register_extcon() on the sync\/async boundary:
\ncharger_manager_get_regulators() (regulator_get only, no async producer)
\nnow runs before power_supply_register() so sysfs is not live before
\nregulators are available, and charger_manager_register_extcon() keeps only
\nthe extcon notifier\/work setup, still after power_supply_register() so a
\npower_supply_register() failure cannot reach extcon setup. This keeps the
\nsysfs setup\/teardown ordering symmetric without introducing an asynchronous
\nproducer on the earlier probe-error path.<\/p>\n
Move power_supply_unregister() and try_charger_enable(cm, false) ahead of
\nthe regulator_put() loop on both teardown paths, and adjust err_reg_extcon
\n(power_supply_unregister() then fall through err_regulator for
\nregulator_put(); get_regulators self-rolls back on its own failure).<\/p>\n
This does not address the separate extcon-notifier-driven deref of the same
\nhandles, which needs its own synchronization design.<\/p>\n
Found by an in-house static analysis tool.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
power: supply: charger-manager: register regulators before exposing sysfs<\/p>\n
charger_manager_remove() and the err_reg_extcon probe er<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21394","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21394","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21394"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}