Tzung-Bi Shih e1da6e399d platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver ...

commit 944edca81e upstream.

After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.

The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously.  Fix it.

Fixes: 26a14267af ("platform/chrome: Add ChromeOS EC ISHTP driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-19 13:09:52 +01:00

..

wilco_ec

…

chromeos_laptop.c

platform/chrome: fix double-free in chromeos_laptop_prepare()

2022-10-26 12:34:52 +02:00

chromeos_pstore.c

…

chromeos_tbmc.c

…

cros_ec_chardev.c

platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

2023-03-30 12:47:50 +02:00

cros_ec_debugfs.c

platform/chrome: cros_ec_debugfs: fix wrong EC message version

2024-08-19 05:44:49 +02:00

cros_ec_i2c.c

platform/chrome: cros_ec: Make cros_ec_unregister() return void

2025-08-28 16:24:32 +02:00

cros_ec_ishtp.c

platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

2026-01-19 13:09:52 +01:00

cros_ec_lightbar.c

…

cros_ec_lpc_mec.c

…

cros_ec_lpc_mec.h

…

cros_ec_lpc.c

platform/chrome: cros_ec: Make cros_ec_unregister() return void

2025-08-28 16:24:32 +02:00

cros_ec_proto.c

platform/chrome: cros_ec_proto: Lock device when updating MKBP version

2024-08-19 05:45:33 +02:00

cros_ec_rpmsg.c

…

cros_ec_sensorhub_ring.c

…

cros_ec_sensorhub_trace.h

…

cros_ec_sensorhub.c

…

cros_ec_spi.c

platform/chrome: cros_ec: Make cros_ec_unregister() return void

2025-08-28 16:24:32 +02:00

cros_ec_sysfs.c

…

cros_ec_trace.c

…

cros_ec_trace.h

…

cros_ec_typec.c

platform/chrome: cros_ec_typec: Defer probe on missing EC parent

2025-08-28 16:24:19 +02:00

cros_ec_vbc.c

…

cros_ec.c

platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()

2025-08-28 16:24:32 +02:00

cros_ec.h

platform/chrome: cros_ec: Make cros_ec_unregister() return void

2025-08-28 16:24:32 +02:00

cros_kbd_led_backlight.c

…

cros_usbpd_logger.c

…

cros_usbpd_notify.c

platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()

2022-12-31 13:14:02 +01:00

Kconfig

…

Makefile

…