Tzung-Bi Shih 4701493ba3 platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver ...

commit 944edca81e upstream.

After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.

The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously.  Fix it.

Fixes: 26a14267af ("platform/chrome: Add ChromeOS EC ISHTP driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-08 10:14:21 +01:00

..

wilco_ec

…

chromeos_acpi.c

…

chromeos_laptop.c

…

chromeos_privacy_screen.c

…

chromeos_pstore.c

…

chromeos_tbmc.c

…

cros_ec_chardev.c

…

cros_ec_debugfs.c

…

cros_ec_i2c.c

…

cros_ec_ishtp.c

…

cros_ec_lightbar.c

…

cros_ec_lpc_mec.c

…

cros_ec_lpc_mec.h

…

cros_ec_lpc.c

…

cros_ec_proto_test_util.c

…

cros_ec_proto_test_util.h

…

cros_ec_proto_test.c

…

cros_ec_proto.c

…

cros_ec_rpmsg.c

…

cros_ec_sensorhub_ring.c

…

cros_ec_sensorhub_trace.h

…

cros_ec_sensorhub.c

…

cros_ec_spi.c

…

cros_ec_sysfs.c

…

cros_ec_trace.c

…

cros_ec_trace.h

…

cros_ec_typec.c

…

cros_ec_typec.h

…

cros_ec_uart.c

…

cros_ec_vbc.c

…

cros_ec.c

…

cros_ec.h

…

cros_hps_i2c.c

…

cros_kbd_led_backlight.c

…

cros_typec_switch.c

…

cros_typec_vdm.c

…

cros_typec_vdm.h

…

cros_usbpd_logger.c

…

cros_usbpd_notify.c

…

Kconfig

…

Makefile

…