Re: Re [PATCH v3] wmi/core: fix use-after-free in wmi_add_device()

[Armin Wolf]

Am 23.06.26 um 02:12 schrieb yahia:

> Hi Armin,
>
> I compiled the kernel while dropping
> HL_FLAG_AUTOREMOVE_SUPPLIER and the kernel
> functioned normally, all my hotkeys worked
> and i couldn't find any memory leak or issue
> with KASAN, so in my testing it seems safe to
> drop HL_FLAG_AUTOREMOVE_SUPPLIER.
>
> Best regards,
> yahia
Thanks for testing this. I did a similar test where i also removed the DL_FLAG_AUTOREMOVE_SUPPLIER
flag. However i also modified wmi_add_device() to always fail with -EINVAL.

This resulted in the following error when the WMI driver was unbound and later rebound to the same
PNP0C14 device:

kobject: kobject_add_internal failed for platform:PNP0C14:00--wmi:C3021213-D0BC-41A2-BA17-816CD5ED7744-0 with -EEXIST, don't try to register things with the same name in the same directory.

It seems that without DL_FLAG_AUTOREMOVE_SUPPLIER, all device links will remain even after the WMI core driver
has been unbound from a given device. This causes a name clash when said driver is bound again to the same
device.

Because of this i do not think that we should remove this flag. It seems that the driver core does not remove the link
automatically if the consumer device was not successfully added using device_add().

Thanks,
Armin Wolf