korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 04:18:39 +08:00
Code Issues Packages Projects Releases Wiki Activity
203b283cc1
linux/drivers
History
Sicong Huang 5c9c5d7f26 greybus: Fix use-after-free bug in gb_interface_release due to race condition. 
In gb_interface_create, &intf->mode_switch_completion is bound with
gb_interface_mode_switch_work. Then it will be started by
gb_interface_request_mode_switch. Here is the relevant code.
if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
	...
}

If we call gb_interface_release to make cleanup, there may be an
unfinished work. This function will call kfree to free the object
"intf". However, if gb_interface_mode_switch_work is scheduled to
run after kfree, it may cause use-after-free error as
gb_interface_mode_switch_work will use the object "intf".
The possible execution flow that may lead to the issue is as follows:

CPU0                            CPU1

                            |   gb_interface_create
                            |   gb_interface_request_mode_switch
gb_interface_release        |
kfree(intf) (free)          |
                            |   gb_interface_mode_switch_work
                            |   mutex_lock(&intf->mutex) (use)

Fix it by canceling the work before kfree.

Signed-off-by: Sicong Huang <congei42@163.com>
Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-04 18:59:41 +02:00
..
accel accel/ivpu: Fix deadlock in context_xa 2024-04-08 10:55:01 +02:00
accessibility Merge 6.9-rc5 into char-misc-next 2024-04-23 13:16:03 +02:00
acpi coresight: debug: Move ACPI support from AMBA driver to platform driver 2024-04-16 11:30:47 +01:00
amba
android binder: check offset alignment in binder_get_object() 2024-04-11 15:19:12 +02:00
ata ata: libata-core: Allow command duration limits detection for ACS-4 drives 2024-04-13 10:42:28 +09:00
atm atm: fore200e: Convert to platform remove callback returning void 2024-03-07 20:36:32 -08:00
auxdisplay auxdisplay: img-ascii-lcd: Convert to platform remove callback returning void 2024-03-12 17:37:54 +02:00
base IIO: 1st set of new device support, features and cleanup for 6.10 2024-04-23 20:19:37 -07:00
bcma
block nullblk: Fix cleanup order in null_add_dev() error path 2024-04-02 07:43:24 -06:00
bluetooth Bluetooth: qca: fix device-address endianness 2024-03-29 09:48:37 -04:00
bus bus: mhi: host: pci_generic: Add generic edl_trigger to allow devices to enter EDL mode 2024-04-25 20:25:45 +05:30
cache cache: sifive_ccache: Partially convert to a platform driver 2024-03-28 22:40:56 +00:00
cdrom cdrom: gdrom: Convert to platform remove callback returning void 2024-03-07 11:53:30 -07:00
cdx cdx: Convert to platform remove callback returning void 2024-04-13 12:41:01 +02:00
char ppdev: Add an error check in register_device 2024-05-04 18:59:38 +02:00
clk clk: mediatek: mt7988-infracfg: fix clocks for 2nd PCIe port 2024-04-10 20:50:26 -07:00
clocksource A set of updates for clocksource and clockevent drivers: 2024-03-23 14:42:45 -07:00
comedi Merge 6.9-rc5 into char-misc-next 2024-04-23 13:16:03 +02:00
connector
counter counter: ti-ecap-capture: Utilize COUNTER_COMP_FREQUENCY macro 2024-04-02 13:15:03 -04:00
cpufreq RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
cpuidle RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
crypto x86/CPU/AMD: Track SNP host status with cc_platform_*() 2024-04-04 10:40:30 +02:00
cxl cxl fixes for v6.9-rc4 2024-04-11 16:49:11 -07:00
dax libnvdimm updates for v6.9 2024-03-15 11:58:32 -07:00
dca
devfreq
dio dio: make dio_bus_type const 2024-03-07 20:37:04 +00:00
dma dmaengine updates for v6.9 2024-03-15 12:25:13 -07:00
dma-buf Merge drm/drm-fixes into drm-misc-fixes 2024-03-25 21:11:58 +01:00
dpll dpll: indent DPLL option type by a tab 2024-03-25 19:40:23 -07:00
edac - Add a FRU (Field Replaceable Unit) memory poison manager which 2024-03-11 18:14:06 -07:00
eisa
extcon
firewire firewire: ohci: mask bus reset interrupts between ISR and bottom half 2024-04-06 09:36:46 +09:00
firmware Arm FF-A fix for v6.9 2024-04-09 16:29:48 +02:00
fpga fpga: region: add owner module and take its refcount 2024-04-23 15:37:20 +08:00
fsi
gnss
gpio gpio: lpc32xx: fix module autoloading 2024-04-12 21:30:58 +02:00
gpu - Fix bo leak on error path during fb init 2024-04-19 10:40:47 +10:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-05-04 18:59:41 +02:00
hid hid-for-linus-2024031301 2024-03-14 09:56:15 -07:00
hsi HSI: ssi_protocol: fix struct members kernel-doc warnings 2024-02-25 19:05:45 +01:00
hte
hv Merge 6.9-rc5 into char-misc-next 2024-04-23 13:16:03 +02:00
hwmon - Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min 2024-03-14 18:03:09 -07:00
hwspinlock hwspinlock: omap: Use index to get hwspinlock pointer 2024-03-05 20:01:14 -08:00
hwtracing intel_th: pci: Add Lunar Lake support 2024-05-04 18:57:23 +02:00
i2c i2c: pxa: hide unused icr_bits[] variable 2024-04-04 01:07:57 +02:00
i3c
idle cpuidle: ACPI/intel: fix MWAIT hint target C-state computation 2024-03-05 21:25:18 +01:00
iio iio: temperature: mcp9600: Fix temperature reading for negative values 2024-05-03 11:48:56 +01:00
infiniband RDMA/mlx5: Fix port number for counter query in multi-port configuration 2024-04-08 13:33:10 +03:00
input TTY/Serial driver update for 6.9-rc1 2024-03-21 12:44:10 -07:00
interconnect interconnect changes for 6.10 2024-05-04 09:47:38 +02:00
iommu iommufd for 6.9 first rc 2024-04-19 14:02:21 -07:00
ipack ipack: make ipack_bus_type const 2024-03-07 20:32:47 +00:00
irqchip irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 2024-04-09 11:11:18 +02:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-04-09 17:01:01 -07:00
leds - Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min 2024-03-14 18:03:09 -07:00
macintosh powerpc updates for 6.9 2024-03-15 17:53:48 -07:00
mailbox imx: add support for i.MX95 ELE/V2X MU 2024-03-13 12:23:36 -07:00
mcb mcb: lpc: Convert to platform remove callback returning void 2024-04-29 10:53:31 +02:00
md Merge tag 'md-6.9-20240408' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.9 2024-04-08 21:49:27 -06:00
media media: mediatek: vcodec: support 36 bits physical address 2024-03-26 09:52:59 +01:00
memory Char/Misc and other driver subsystem updates for 6.9-rc1 2024-03-21 13:21:31 -07:00
memstick MMC core: 2024-03-13 10:59:28 -07:00
message
mfd TTY/Serial driver update for 6.9-rc1 2024-03-21 12:44:10 -07:00
misc vmci: prevent speculation leaks by sanitizing event in event_deliver() 2024-05-03 07:28:53 +02:00
mmc GPIO regression fixes for n8x0 2024-04-09 16:17:37 +02:00
most most: core: make mostbus const 2024-03-07 20:32:38 +00:00
mtd fs,block: yield devices early 2024-03-27 13:17:15 +01:00
mux
net A little calmer than usual, probably just the timing of sub-tree PRs. 2024-04-18 11:40:54 -07:00
nfc
ntb
nubus
nvdimm libnvdimm updates for v6.9 2024-03-15 11:58:32 -07:00
nvme nvme-fc: rename free_ctrl callback to match name pattern 2024-04-04 08:47:56 -07:00
nvmem nvmem: meson-mx-efuse: Remove nvmem_device from efuse struct 2024-05-03 07:26:39 +02:00
of of: module: prevent NULL pointer dereference in vsnprintf() 2024-03-27 17:05:07 -05:00
opp OPP: Extend dev_pm_opp_data with turbo support 2024-03-11 10:39:24 +05:30
parisc parisc: led: Convert to platform remove callback returning void 2024-03-08 10:00:07 +01:00
parport parport: mfc3: avoid empty-body warning 2024-04-11 15:14:10 +02:00
pci Revert "PCI: Mark LSI FW643 to avoid bus reset" 2024-03-29 11:57:12 -05:00
pcmcia pcmcia: cs: make pcmcia_socket_class constant 2024-03-10 09:07:00 +01:00
peci peci: constify the struct device_type usage 2024-04-16 00:14:43 +02:00
perf drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported 2024-03-26 14:09:18 -07:00
phy USB/Thunderbolt changes for 6.9-rc1 2024-03-21 12:35:20 -07:00
pinctrl Kbuild fixes for v6.9 2024-03-31 11:23:51 -07:00
platform platform-drivers-x86 for v6.9-3 2024-04-18 07:15:33 -07:00
pmdomain Core: 2024-03-13 11:33:10 -07:00
pnp
power power supply and reset changes for the 6.9 series 2024-03-14 10:19:48 -07:00
powercap powercap: intel_rapl: Convert to platform remove callback returning void 2024-03-13 20:45:54 +01:00
pps pps: use cflags-y instead of EXTRA_CFLAGS 2024-03-07 21:51:39 +00:00
ps3
ptp Networking changes for 6.9. 2024-03-12 17:44:08 -07:00
pwm pwm: dwc: allow suspend/resume for 16 channels 2024-04-15 17:28:13 +02:00
rapidio
ras RAS: Avoid build errors when CONFIG_DEBUG_FS=n 2024-03-26 21:48:21 +01:00
regulator regulator: tps65132: Add of_match table 2024-03-25 19:28:27 +00:00
remoteproc remoteproc updates for v6.9 2024-03-21 10:37:39 -07:00
reset
rpmsg
rtc RTC for 6.9 2024-03-21 17:16:46 -07:00
s390 s390 updates for 6.9-rc5 2024-04-19 09:59:15 -07:00
sbus This includes the following changes related to sparc for v6.9: 2024-03-15 12:47:21 -07:00
scsi scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING 2024-04-08 21:40:29 -04:00
sh
siox SIOX changes for 6.9-rc1 2024-03-21 15:18:18 -07:00
slimbus slimbus: qcom-ctrl: fix module autoloading 2024-05-03 07:28:16 +02:00
soc Including fixes from CAN, netfilter, wireguard and IPsec. 2024-03-21 14:50:39 -07:00
soundwire soundwire updates for 6.9 2024-03-15 12:22:52 -07:00
spi spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe 2024-04-03 11:04:58 +01:00
spmi
ssb
staging staging: vc04_services: fix information leak in create_component() 2024-03-25 19:10:01 +01:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-04-05 21:37:54 -04:00
tc
tee ARM: SoC drivers for 6.9 2024-03-12 10:35:24 -07:00
thermal thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up() 2024-04-19 15:08:19 +02:00
thunderbolt thunderbolt: Avoid notify PM core about runtime PM resume 2024-04-10 10:49:58 +03:00
tty serial: stm32: Reset .throttled state in .startup() 2024-04-17 13:26:45 +02:00
ufs scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5 2024-04-08 15:06:56 -04:00
uio Merge 6.9-rc5 into char-misc-next 2024-04-23 13:16:03 +02:00
usb USB-serial device ids for 6.9-rc5 2024-04-19 16:07:18 +02:00
vdpa vDPA: report virtio-blk flush info to user space 2024-03-19 02:45:51 -04:00
vfio VFIO updates for v6.9-rc1 2024-03-15 13:21:13 -07:00
vhost vhost: correct misleading printing information 2024-04-08 04:11:04 -04:00
video fbdev: Select I/O-memory framebuffer ops for SBus 2024-03-25 21:34:08 +01:00
virt Revert "vmgenid: emit uevent when VMGENID updates" 2024-04-18 14:47:23 +02:00
virtio virtio: store owner from modules with register_virtio_driver() 2024-04-08 04:11:04 -04:00
w1 w1: gpio: Don't use "proxy" headers 2024-03-25 12:06:37 +01:00
watchdog linux-watchdog 6.9-rc1 tag 2024-03-17 12:06:10 -07:00
xen xen: branch for v6.9-rc1 2024-03-19 08:48:09 -07:00
zorro
Kconfig
Makefile Revert "leds: Only descend into leds directory when CONFIG_NEW_LEDS is set" 2024-03-07 08:48:10 +00:00