From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15EEC1FA859 for ; Mon, 22 Jun 2026 19:04:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782155060; cv=none; b=NcRDEi6TnDfDsxs+UwjyoYhV2OCZxhCqM566X6mvnMTAL9DqpybYYycM5yLP66Fdtp9SrX8SaGKONyzLZ/fcLNtiu5FWqkl4mQHxOpDatTnmR0Mw1rbJjcqYqUMp/HqakO+yMcgyZc/+V6CAy0knt+RGzCpXQYM6BUU8Cw7G0Fo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782155060; c=relaxed/simple; bh=QL2Q6znCXijD6enFZDJMIOaOf8peNpHGtLos9K3RVxI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=B/WFMHS670CnwfKfeFUzCAUzmsNDUi9ijfuyGPHafcIZOfLev9td1OC3y2blPDVubf6GIEsqcCioimgCipCRnLJvJNUhF/ALyR4Z64uMUKWbeBBpHIkMNiRuOK4i9GC49JKP7JyT2Ctfx41OZJ0/e85ZiGjn0EhaFV3Ob6OvK94= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NTYXnud4; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NTYXnud4" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-490b613a17bso39618245e9.3 for ; Mon, 22 Jun 2026 12:04:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782155057; x=1782759857; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=MIdFp1y6C9M5AK+aZgErDVJD9llkNcU+k6yHQJt/n8Y=; b=NTYXnud4njNgaATKB/8md33afcqyMtyRPxcRCpEcSn1rpLYuPy5c+H4lL2ZNRBPNwb Xdu1AIYIBJpAVsyTOwtRhG79vI9mvP5nSbEGsJWRqsLAnYXowvPosYnQzpUAQbAbxvSd exTqzbM7uZ8T+cjz12llkBIZxLADC6eEHxR8D2PbjRuFI2zSV0+Te2b3CzOxOynPhKm7 aGCzFU/RSwO7anvh2jEQsRtj3Cs4K7cforQ8VDn2bCZu7Vt6851Y53O4wpCvAg59eJdF ssPEa31WNDb1a0Qx2/2i1qybWObflXdhRX3FrQ56ZTqvvjIG/xnAfzm3Lm6otdHSCHWo /1Bg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782155057; x=1782759857; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=MIdFp1y6C9M5AK+aZgErDVJD9llkNcU+k6yHQJt/n8Y=; b=KTKKF6y5jQJWfdYVq2l51Yq3CxwKYWhQIsJcGwdpXoYmrninLxgBKru8VypFxAdvKG Mw3Bt88kQ2Mtb7X+ez9+AAVdVscgP5HxoglVgP9wJFkxcNIjNWfg4en6w2sLWoE7DxVx bO2TqZE+y4SdWd3zaqroZ2+UfzEK5tS/mo1TDT0eZ43zW7ZhP8C4CaiJhs/QtSLodkY2 oSzSQA7wlZPdAVavAigqTWNuHOHogVSQJCVmuWWOfeGSu7UYfHxzpXO/V2hdfEUMZ8bC iUSPsrAWZ6kcZulFyDM97hr4EQAXIwp85B1bQ6CygdKK6uRJwRROrd/DuL0wYQ8fay83 rziw== X-Forwarded-Encrypted: i=1; AFNElJ/laUhyQA/b7Xh2KCDzB3P3WNZHN/qBrky8EEanSSFlELq4sq5hq5Dcn7ZPGUqhX1+hu1JIzVJAykQkpxg=@vger.kernel.org X-Gm-Message-State: AOJu0YzJrwNI/uXYvtHh+TtZNGUCVelkcisFRR6WRkBqbxrTzm95BkQR L9PWj+v5PCUHQQs6vqo4Ki/dOp3DNXASag4o0pj5F14sr/AqrzNhagwX X-Gm-Gg: AfdE7cloxnkHlCioyquMrd0u0nNUM5vlX+R2x1TZAWrsH6/H1PGyOtD6W0QGfku3fnw htlDftNpqDmm0Co6C0Pohgv+xbtWyH9Pf6GMzSa+cSiiS2+S+o5eABYKm80ewmLHxpJqX4xvyxI 6bizO5zrdtIykP+RsWSl7tsVRlCcnIYvKGaw6qNlrHfMt2cda/80Kig+iGctI6FAjVK+MngkQiM 5swsueZ9fmrsDRlyZ4vdOxLfHOEugYNa8ZSPzmLZBX+ipugAk/C0gUGe2l+x7Y4o1YMrshQPbkI L1MP71P3C6mx7oc77LwSLjGQAE8FpNgPwh1/9e0qO8cl9AcArWDTPwucSgn+nCdL2Zn9uTcTZBV U0Zjb1l/WH2gWR/tBEVAoigGD6qdnWzixarQGQpAnuunMHD1h68C3rcaNiuMzhLsCnTkwSrVc+7 Eudzm/sD381ZU= X-Received: by 2002:a05:600c:6211:b0:490:688b:f9f8 with SMTP id 5b1f17b1804b1-492490af44amr172136995e9.27.1782155057246; Mon, 22 Jun 2026 12:04:17 -0700 (PDT) Received: from user ([104.28.162.144]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-466667881bfsm30154422f8f.22.2026.06.22.12.04.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jun 2026 12:04:16 -0700 (PDT) From: yahia To: W_Armin@gmx.de Cc: platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, yahia ahmed Subject: [PATCH v2] wmi/core: fix use-after-free in wmi_add_device() Date: Mon, 22 Jun 2026 22:04:09 +0300 Message-ID: <20260622190409.17268-1-yahia.a.abdrabou@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <8b505aea-2c76-4868-b30c-be34ce0eb761@gmx.de> References: <8b505aea-2c76-4868-b30c-be34ce0eb761@gmx.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: yahia ahmed Hi Armin, You are correct about kzalloc_obj overriding wblock and I apologize, However there is a different use-after-free specifically in wmi_add_device() function, where if device_add() fails, the function forwards the return code, then the caller function parse_wdg() frees wblock from memory, but doesnt remove wblock from pdev's list, thus if pdev calls wblock for any reason like suspendension or similar activities, it will call freed memory, hence the use-after-free. I propose to fix this by adding device_link_del() function if device_add() function fails, remove wblock from pdev's list, thus avoiding a possible use-after-free. Signed-off-by: yahia ahmed --- drivers/platform/wmi/core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c index 5a2ffcbab6af..8c9b7ac2e5d8 100644 --- a/drivers/platform/wmi/core.c +++ b/drivers/platform/wmi/core.c @@ -1261,6 +1261,7 @@ static int wmi_create_device(struct device *wmi_bus_dev, static int wmi_add_device(struct platform_device *pdev, struct wmi_device *wdev) { struct device_link *link; + int ret; /* * Many aggregate WMI drivers do not use -EPROBE_DEFER when they @@ -1275,7 +1276,11 @@ static int wmi_add_device(struct platform_device *pdev, struct wmi_device *wdev) if (!link) return -EINVAL; - return device_add(&wdev->dev); + ret = device_add(&wdev->dev); + + if (ret) + device_link_del(link); + return ret; } @@ -1418,7 +1424,7 @@ static int wmi_notify_device(struct device *dev, void *data) return 0; /* The ACPI WMI specification says that _WED should be - * evaluated every time an notification is received, even + * evaluated every time a notification is received, even * if no consumers are present. * * Some firmware implementations actually depend on this -- 2.54.0