]> git.ipfire.org Git - thirdparty/linux.git/commit
hwmon: (ibmpex) fix use-after-free in high/low store
authorJunrui Luo <moonafterrain@outlook.com>
Wed, 10 Dec 2025 09:48:08 +0000 (17:48 +0800)
committerGuenter Roeck <linux@roeck-us.net>
Sun, 14 Dec 2025 17:35:43 +0000 (09:35 -0800)
commit6946c726c3f4c36f0f049e6f97e88c510b15f65d
tree6697cefa9284ff9661aa4ad78c1a0bfad233b99f
parent46c28bbbb150b80827e4bcbea231560af9d16854
hwmon: (ibmpex) fix use-after-free in high/low store

The ibmpex_high_low_store() function retrieves driver data using
dev_get_drvdata() and uses it without validation. This creates a race
condition where the sysfs callback can be invoked after the data
structure is freed, leading to use-after-free.

Fix by adding a NULL check after dev_get_drvdata(), and reordering
operations in the deletion path to prevent TOCTOU.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://lore.kernel.org/r/MEYPR01MB7886BE2F51BFE41875B74B60AFA0A@MEYPR01MB7886.ausprd01.prod.outlook.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
drivers/hwmon/ibmpex.c