Damian Muszynski 226fc408c5 crypto: qat - resolve race condition during AER recovery ... [ Upstream commit 7d42e09760 ] During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will exit due to a timeout, and the reset_data structure will be freed. However, this data structure is used for completion notification after the restart is completed, which leads to a UAF bug. This results in a KFENCE bug notice. BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat] Use-after-free read at 0x00000000bc56fddf (in kfence-#142): adf_device_reset_worker+0x38/0xa0 [intel_qat] process_one_work+0x173/0x340 To resolve this race condition, the memory associated to the container of the work_struct is freed on the worker if the timeout expired, otherwise on the function that schedules the worker. The timeout detection can be done by checking if the caller is still waiting for completion or not by using completion_done() function. Fixes: d8cba25d2c ("crypto: qat - Intel(R) QAT driver framework") Cc: <stable@vger.kernel.org> Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-03 15:19:26 +02:00
..
accessibility
acpi	ACPI: scan: Fix device check notification handling	2024-03-26 18:20:38 -04:00
amba
android	binder: signal epoll threads of self-work	2024-02-23 09:12:39 +01:00
ata	ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts	2024-03-01 13:26:39 +01:00
atm	atm: idt77252: fix a memleak in open_card_ubr0	2024-02-16 19:06:26 +01:00
auxdisplay	auxdisplay: hd44780: move cursor home after clear display command	2023-12-08 08:51:16 +01:00
base	x86/rfds: Mitigate Register File Data Sampling (RFDS)	2024-03-15 10:48:21 -04:00
bcma
block	aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts	2024-03-26 18:20:29 -04:00
bluetooth	Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()	2024-03-26 18:20:40 -04:00
bus	bus: tegra-aconnect: Update dependency to ARCH_TEGRA	2024-03-26 18:20:36 -04:00
cdrom
char	hwrng: core - Fix page fault dead lock on mmap-ed hwrng	2024-01-31 16:16:58 -08:00
clk	clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd	2024-04-03 15:19:24 +02:00
clocksource	clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings	2024-01-25 15:27:39 -08:00
comedi	comedi: comedi_test: Prevent timers rescheduling during deletion	2024-03-26 18:20:57 -04:00
connector
counter	counter: microchip-tcb-capture: Fix the use of internal GCLK logic	2023-10-19 23:08:58 +02:00
cpufreq	cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()	2024-04-03 15:19:25 +02:00
cpuidle
crypto	crypto: qat - resolve race condition during AER recovery	2024-04-03 15:19:26 +02:00
cxl	cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window	2024-03-01 13:26:31 +01:00
dax
dca
devfreq	PM / devfreq: Synchronize devfreq_monitor_[start/stop]	2024-02-05 20:12:47 +00:00
dio
dma	dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA	2024-03-26 18:20:45 -04:00
dma-buf	dma-buf: fix check in dma_resv_add_fence	2023-12-08 08:51:15 +01:00
edac	EDAC/thunderx: Fix possible out-of-bounds string access	2024-01-25 15:27:18 -08:00
eisa
extcon
firewire	firewire: core: use long bus reset on gap count error	2024-03-26 18:20:27 -04:00
firmware	x86/efistub: Don't clear BSS twice in mixed mode	2024-03-26 18:21:03 -04:00
fpga
fsi
gnss
gpio	gpio: vf610: allow disabling the vf610 driver	2024-03-26 18:20:33 -04:00
gpu	drm/vmwgfx: Fix possible null pointer derefence with invalid contexts	2024-04-03 15:19:24 +02:00
greybus
hid	HID: amd_sfh: Avoid disabling the interrupt	2024-03-26 18:20:51 -04:00
hsi
hte	hte: tegra: Fix missing error code in tegra_hte_test_probe()	2023-11-20 11:51:58 +01:00
hv
hwmon	hwmon: (coretemp) Enlarge per package core count limit	2024-03-01 13:26:29 +01:00
hwspinlock	hwspinlock: qcom: add missing regmap config for SFPB MMIO implementation	2023-09-19 12:28:05 +02:00
hwtracing	hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()	2024-03-26 18:20:58 -04:00
i2c	i2c: imx: when being a target, mark the last read as processed	2024-03-01 13:26:38 +01:00
i3c	i3c: master: cdns: Update maximum prescaler value for i2c clock	2024-02-05 20:12:58 +00:00
idle	intel_idle: add Emerald Rapids Xeon support	2023-10-10 22:00:44 +02:00
iio	iio: imu: bno055: serdev requires REGMAP	2024-02-23 09:12:41 +01:00
infiniband	RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()	2024-03-26 18:20:55 -04:00
input	Input: gpio_keys_polled - suppress deferred probe error for gpio	2024-03-26 18:20:27 -04:00
interconnect	Revert "interconnect: Teach lockdep about icc_bw_lock order"	2024-03-06 14:45:19 +00:00
iommu	iommu: Fix compilation without CONFIG_IOMMU_INTEL	2024-03-26 18:20:41 -04:00
ipack
irqchip	irqchip/sifive-plic: Enable interrupt if needed before EOI	2024-03-01 13:26:32 +01:00
isdn
leds	leds: sgm3140: Add missing timer cleanup and flash gpio control	2024-03-26 18:20:52 -04:00
macintosh
mailbox	mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt	2024-02-05 20:12:58 +00:00
mcb	mcb: fix error handling for different scenarios when parsing	2023-11-28 17:07:13 +00:00
md	dm-integrity: align the outgoing bio in integrity_recheck	2024-03-26 18:21:03 -04:00
media	media: mc: Expand MUST_CONNECT flag to always require an enabled link	2024-04-03 15:19:25 +02:00
memory
memstick
message
mfd	mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref	2024-03-26 18:20:50 -04:00
misc	misc: open-dice: Fix spurious lockdep warning	2024-03-01 13:26:27 +01:00
mmc	mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function	2024-03-26 18:20:39 -04:00
most
mtd	mtd: rawnand: lpc32xx_mlc: fix irq handler prototype	2024-03-26 18:20:51 -04:00
mux
net	wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach	2024-04-03 15:19:23 +02:00
nfc
ntb	NTB: fix possible name leak in ntb_register_device()	2024-03-26 18:20:49 -04:00
nubus
nvdimm	nd_btt: Make BTT lanes preemptible	2023-11-20 11:52:05 +01:00
nvme	nvme: fix reconnection fail due to reserved tag allocation	2024-03-26 18:20:59 -04:00
nvmem	nvmem: imx: correct nregs for i.MX6UL	2023-11-02 09:35:31 +01:00
of	of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing	2024-03-06 14:45:09 +00:00
opp	OPP: debugfs: Fix warning around icc_get_name()	2024-03-26 18:20:42 -04:00
parisc	parisc/power: Fix power soft-off button emulation on qemu	2024-01-31 16:16:59 -08:00
parport	parport: parport_serial: Add Brainboxes device IDs and geometry	2024-01-20 11:50:11 +01:00
pci	PCI: Mark 3ware-9650SE Root Port Extended Tags as broken	2024-03-26 18:20:50 -04:00
pcmcia	pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()	2023-11-20 11:52:13 +01:00
peci
perf	perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child count)	2024-03-26 18:20:24 -04:00
phy	phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes	2024-03-06 14:45:19 +00:00
pinctrl	gpio: nomadik: fix offset bug in nmk_pmx_set()	2024-03-26 18:20:52 -04:00
platform	platform/x86: thinkpad_acpi: Only update profile if successfully converted	2024-03-01 13:26:37 +01:00
pnp	PNP: ACPI: fix fortify warning	2024-02-05 20:12:47 +00:00
power	power: supply: bq27xxx-i2c: Do not free non existing IRQ	2024-03-06 14:45:09 +00:00
powercap	powercap: dtpm_cpu: Fix error check against freq_qos_add_request()	2024-03-26 18:20:36 -04:00
pps
ps3
ptp	ptp: annotate data-race around q->head and q->tail	2023-11-28 17:07:05 +00:00
pwm	pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan	2024-03-26 18:20:34 -04:00
rapidio
ras
regulator	regulator: pwm-regulator: Add validity checks in continuous .get_voltage	2024-03-01 13:26:26 +01:00
remoteproc	remoteproc: virtio: Fix wdg cannot recovery remote processor	2024-04-03 15:19:24 +02:00
reset	reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning	2024-01-20 11:50:07 +01:00
rpmsg	rpmsg: virtio: Free driver_override when rpmsg_remove()	2024-01-31 16:16:59 -08:00
rtc	rtc: mt6397: select IRQ_DOMAIN instead of depending on it	2024-03-26 18:20:58 -04:00
s390	s390/dasd: fix double module refcount decrement	2024-03-26 18:20:28 -04:00
sbus
scsi	scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn	2024-03-26 18:20:55 -04:00
sh
siox
slimbus
soc	soc: fsl: dpio: fix kcalloc() argument order	2024-03-26 18:20:59 -04:00
soundwire	soundwire: stream: fix NULL pointer dereference for multi_link	2023-12-20 17:00:25 +01:00
spi	spi: spi-mt65xx: Fix NULL pointer access in interrupt handler	2024-03-26 18:21:02 -04:00
spmi	spmi: mediatek: Fix UAF on device remove	2024-02-05 20:12:58 +00:00
ssb
staging	media: staging: ipu3-imgu: Set fields before media_entity_pads_init()	2024-04-03 15:19:23 +02:00
target	scsi: target: pscsi: Fix bio_put() for error case	2024-03-01 13:26:31 +01:00
tc
tee	tee: optee: Fix supplicant based device enumeration	2023-12-13 18:39:12 +01:00
thermal	thermal: intel: hfi: Add syscore callbacks for system-wide PM	2024-01-31 16:17:09 -08:00
thunderbolt	thunderbolt: Fix memory leak in margining_port_remove()	2024-01-01 12:39:08 +00:00
tty	serial: max310x: fix NULL pointer dereference in I2C instantiation	2024-04-03 15:19:24 +02:00
ufs	scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare()	2024-03-01 13:26:30 +01:00
uio	uio: Fix use-after-free in uio_open	2024-01-20 11:50:10 +01:00
usb	usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin	2024-03-26 18:20:58 -04:00
vdpa	vdpa/mlx5: Allow CVQ size changes	2024-03-26 18:21:00 -04:00
vfio	iommufd/iova_bitmap: Consider page offset for the pages to be pinned	2024-03-01 13:26:35 +01:00
vhost	vhost: use kzalloc() instead of kmalloc() followed by memset()	2024-02-16 19:06:31 +01:00
video	backlight: lp8788: Fully initialize backlight_properties during probe	2024-03-26 18:20:53 -04:00
virt	virt: sevguest: Fix passing a stack buffer as a scatterlist target	2023-11-20 11:52:13 +01:00
virtio	virtio_pci: fix the common cfg map size	2023-11-02 09:35:23 +01:00
vlynq
w1
watchdog	watchdog: stm32_iwdg: initialize default timeout	2024-03-26 18:20:56 -04:00
xen	xen/events: close evtchn after mapping cleanup	2024-03-06 14:45:20 +00:00
zorro
Kconfig
Makefile