In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix memory corruption bug in struct loongson2clkprovider Some heap space is allocated for the flexible structure struct clk_hw_onecell_data
and its flexible-array member hws
through the composite structure struct loongson2_clk_provider
in function loongson2_clk_probe()
, as shown below: 289 struct loongson2clkprovider clp; ... 296 for (p = data; p->name; p++) 297 clks_num++; 298 299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num), 300 GFP_KERNEL); Then some data is written into the flexible array: 350 clp->clk_data.hws[p->id] = hw; This corrupts clk_lock
, which is the spinlock variable immediately following the clk_data
member in struct loongson2_clk_provider
: struct loongson2_clk_provider { void __iomem *base; struct device *dev; struct clk_hw_onecell_data clk_data; spinlock_t clk_lock; / protect access to DIV registers */ }; The problem is that the flexible structure is currently placed in the middle of struct loongson2_clk_provider
instead of at the end. Fix this by moving struct clk_hw_onecell_data clk_data;
to the end of struct loongson2_clk_provider
. Also, add a code comment to help prevent this from happening again in case new members are added to the structure in the future. This change also fixes the following -Wflex-array-member-not-at-end warning: drivers/clk/clk-loongson2.c:32:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-headers-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-oem-dbgsym", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-ipu6-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-ipu7-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-usbio-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-vision-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-oem-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-oem-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-tools-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" } ] }