Re: [PATCH 7/7] firmware: firmware: fix NULL pointer dereference in __fw_load_abort()

[Luis R. Rodriguez]

On Wed, Jan 25, 2017 at 02:36:31PM +0100, Luis R. Rodriguez wrote:
> On Wed, Jan 25, 2017 at 11:52:04AM +0100, Greg KH wrote:
> > On Mon, Jan 23, 2017 at 08:11:11AM -0800, Luis R. Rodriguez wrote:
> > > Since commit 5d47ec02c37ea632398cb251c884e3a488dff794
> > > ("firmware: Correct handling of fw_state_wait() return value")
> > > fw_load_abort(fw_priv) could be called twice and lead us to a
> > > kernel crash. This happens only when the firmware fallback mechanism
> > > (regular or custom) is used. The fallback mechanism exposes a sysfs
> > > interface for userspace to upload a file and notify the kernel when
> > > the file is loaded and ready, or to cancel an upload by echo'ing -1
> > > into on the loading file:
> > > 
> > > echo -n "-1" > /sys/$DEVPATH/loading
> > > 
> > > This will call fw_load_abort(). Some distributions actually have
> > > a udev rule in place to *always* immediately cancel all firmware
> > > fallback mechanism requests (Debian, OpenSUSE), they have:

I made a typo here, OpenSUSE in fact does not carry this. Its so far
only Debian I am aware of.

> > >   $ cat /lib/udev/rules.d/50-firmware.rules
> > >   # stub for immediately telling the kernel that userspace firmware loading
> > >   # failed; necessary to avoid long timeouts with CONFIG_FW_LOADER_USER_HELPER=y
> > >   SUBSYSTEM=="firmware", ACTION=="add", ATTR{loading}="-1

  Luis