Tzung-Bi Shih 24a2062257 platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver ...

commit 944edca81e upstream.

After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.

The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously.  Fix it.

Fixes: 26a14267af ("platform/chrome: Add ChromeOS EC ISHTP driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-02 12:57:19 +01:00

..

wilco_ec

platform/chrome: wilco_ec: Remove redundant semicolons

2025-08-13 09:57:21 +00:00

chromeos_acpi.c

platform/chrome: chromeos_acpi: print hex string for ACPI_TYPE_BUFFER

2023-08-10 11:10:56 +08:00

chromeos_laptop.c

platform/chrome: chromeos_laptop: Replace open coded variant of DEFINE_RES_IRQ()

2025-07-01 07:15:14 +00:00

chromeos_of_hw_prober.c

platform/chrome: of_hw_prober: Support touchscreen probing on Squirtle

2025-04-25 02:16:24 +00:00

chromeos_privacy_screen.c

ACPI: make remove callback of ACPI driver void

2022-11-23 19:11:22 +01:00

chromeos_pstore.c

platform/chrome: chromeos_pstore: Add ecc_size module parameter

2025-06-23 02:36:23 +00:00

chromeos_tbmc.c

platform/chrome: chromeos_tbmc: Report wake events

2019-09-12 16:01:35 +02:00

cros_ec_chardev.c

platform/chrome: cros_ec_chardev: Decouple fops from struct cros_ec_dev

2025-08-11 14:37:29 +08:00

cros_ec_debugfs.c

platform/chrome: cros_ec_debugfs: Avoid -Wflex-array-member-not-at-end warnings

2025-04-07 02:06:55 +00:00

cros_ec_i2c.c

platform/chrome: Centralize common cros_ec_device initialization

2025-09-14 11:34:41 +08:00

cros_ec_ishtp.c

platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

2026-01-02 12:57:19 +01:00

cros_ec_lightbar.c

platform/chrome: Switch back to struct platform_driver::remove()

2024-10-28 08:48:34 +00:00

cros_ec_lpc_mec.c

platform/chrome: cros_ec_lpc: Handle zero length read/write

2024-06-14 02:47:25 +00:00

cros_ec_lpc_mec.h

platform/chrome: cros_ec_lpc: MEC access can use an AML mutex

2024-06-06 03:11:51 +00:00

cros_ec_lpc.c

platform/chrome: Centralize common cros_ec_device initialization

2025-09-14 11:34:41 +08:00

cros_ec_proto_test_util.c

platform/chrome: kunit: make EC protocol tests independent

2023-10-05 18:11:36 +08:00

cros_ec_proto_test_util.h

platform/chrome: kunit: Avoid -Wflex-array-member-not-at-end

2025-05-07 03:04:29 +00:00

cros_ec_proto_test.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

cros_ec_proto.c

platform/chrome: cros_ec: Add a flag to track registration state

2025-09-14 11:34:41 +08:00

cros_ec_rpmsg.c

platform/chrome: Centralize common cros_ec_device initialization

2025-09-14 11:34:41 +08:00

cros_ec_sensorhub_ring.c

platform/chrome: sensorhub: Implement quickselect for median calculation

2023-11-13 12:46:42 +08:00

cros_ec_sensorhub_trace.h

platform: chrome: Split trace include file

2022-03-31 16:56:29 -07:00

cros_ec_sensorhub.c

platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready

2025-06-24 02:49:28 +00:00

cros_ec_spi.c

platform/chrome: Centralize common cros_ec_device initialization

2025-09-14 11:34:41 +08:00

cros_ec_sysfs.c

platform/chrome: cros_ec_sysfs: Expose AP_MODE_ENTRY feature state

2025-02-05 04:03:31 +00:00

cros_ec_trace.c

platform/chrome: Update ChromeOS EC command tracing

2025-01-06 01:25:26 +00:00

cros_ec_trace.h

platform/chrome: use macros for passthru indexes

2022-06-10 02:31:42 +00:00

cros_ec_typec.c

platform/chrome: cros_ec_typec: Check ec platform device pointer

2025-07-23 03:19:16 +00:00

cros_ec_typec.h

platform/chrome: cros_ec_typec: Add support for setting USB mode via sysfs

2025-02-21 01:42:22 +00:00

cros_ec_uart.c

platform/chrome: Centralize common cros_ec_device initialization

2025-09-14 11:34:41 +08:00

cros_ec_vbc.c

sysfs: treewide: switch back to attribute_group::bin_attrs

2025-06-17 10:44:15 +02:00

cros_ec.c

platform/chrome: cros_ec: Add a flag to track registration state

2025-09-14 11:34:41 +08:00

cros_ec.h

platform/chrome: Centralize cros_ec_device allocation

2025-09-14 11:34:41 +08:00

cros_hps_i2c.c

platform/chrome: Drop explicit initialization of struct i2c_device_id::driver_data to 0

2024-09-30 01:34:01 +00:00

cros_kbd_led_backlight.c

platform/chrome: cros_kbd_led_backlight: Avoid -Wflex-array-member-not-at-end warnings

2025-04-07 02:04:55 +00:00

cros_typec_altmode.c

platform/chrome: cros_ec_typec: Thunderbolt support

2024-12-24 08:56:05 +01:00

cros_typec_altmode.h

platform/chrome: cros_ec_typec: Thunderbolt support

2024-12-24 08:56:05 +01:00

cros_typec_switch.c

platform/chrome: Switch back to struct platform_driver::remove()

2024-10-28 08:48:34 +00:00

cros_typec_vdm.c

platform/chrome: cros_typec_vdm: Mark port_amode_ops const

2023-10-04 11:40:54 +08:00

cros_typec_vdm.h

platform/chrome: cros_typec_vdm: Mark port_amode_ops const

2023-10-04 11:40:54 +08:00

cros_usbpd_logger.c

platform/chrome: cros_usbpd_logger: Use str_enabled_disabled() helper

2025-01-13 07:39:46 +00:00

cros_usbpd_notify.c

platform/chrome: Switch back to struct platform_driver::remove()

2024-10-28 08:48:34 +00:00

Kconfig

platform/chrome: Fix typo in CROS_USBPD_NOTIFY help text

2025-07-23 23:09:44 +00:00

Makefile

platform/chrome: cros_ec_proto: Allow to build as module

2025-04-07 02:51:00 +00:00