From: Sami Tolvanen samitolvanen@google.com
commit 492c88720d36eb662f9f10c1633f7726fbb07fc4 upstream.
platform_find_device_by_driver calls bus_find_device and passes platform_match as the callback function. Casting the function to a mismatching type trips indirect call Control-Flow Integrity (CFI) checking.
This change adds a callback function with the correct type and instead of casting the function, explicitly casts the second parameter to struct device_driver* as expected by platform_match.
Fixes: 36f3313d6bff9 ("platform: Add platform_find_device_by_driver() helper") Signed-off-by: Sami Tolvanen samitolvanen@google.com Reviewed-by: Kees Cook keescook@chromium.org Cc: stable stable@vger.kernel.org Link: https://lore.kernel.org/r/20191112214156.3430-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/base/platform.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -1278,6 +1278,11 @@ struct bus_type platform_bus_type = { }; EXPORT_SYMBOL_GPL(platform_bus_type);
+static inline int __platform_match(struct device *dev, const void *drv) +{ + return platform_match(dev, (struct device_driver *)drv); +} + /** * platform_find_device_by_driver - Find a platform device with a given * driver. @@ -1288,7 +1293,7 @@ struct device *platform_find_device_by_d const struct device_driver *drv) { return bus_find_device(&platform_bus_type, start, drv, - (void *)platform_match); + __platform_match); } EXPORT_SYMBOL_GPL(platform_find_device_by_driver);