fsl-mc DriverOverride UAF

Vulnerability analysis

Summary: Race condition in FSL-MC bus driver_override sysfs attribute access leading to use-after-free vulnerability

Root Cause: The driver_override_show() function reads the driver_override string without holding the device_lock, while driver_override_store() modifies and frees the same string while holding the device_lock. This creates a race condition where the show function can access freed memory if the store function deallocates the string concurrently.

Attack Surface: Local access required to sysfs filesystem (/sys/bus/fsl-mc/devices/*/driver_override). Attackers need ability to read and write sysfs attributes simultaneously from multiple threads/processes. Affects systems with FSL-MC (Freescale Management Complex) hardware, typically NXP Layerscape SoCs used in networking and automotive applications.

Fix Mechanism: The patch adds proper locking by acquiring device_lock before reading the driver_override string in driver_override_show() and releasing it after the read operation completes. This ensures mutual exclusion with the store operation that already holds the same lock, preventing concurrent access to the string during modification/deallocation.