renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-26 14:14:01 +08:00
Code
c85400f886
linux-next/drivers/usb/host
History
Jia-Ju Bai c85400f886 usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() 
The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
be concurrently executed.
The two functions both access a possible shared variable "hep->hcpriv".

This shared variable is freed by r8a66597_endpoint_disable() via the
call path:
r8a66597_endpoint_disable
  kfree(hep->hcpriv) (line 1995 in Linux-4.19)

This variable is read by r8a66597_urb_enqueue() via the call path:
r8a66597_urb_enqueue
  spin_lock_irqsave(&r8a66597->lock)
  init_pipe_info
    enable_r8a66597_pipe
      pipe = hep->hcpriv (line 802 in Linux-4.19)

The read operation is protected by a spinlock, but the free operation
is not protected by this spinlock, thus a concurrency use-after-free bug
may occur.

To fix this bug, the spin-lock and spin-unlock function calls in
r8a66597_endpoint_disable() are moved to protect the free operation.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-19 08:13:26 +01:00
..
whci USB: host: whci: remove redundant variable t 2018-07-13 15:41:56 +02:00
bcma-hcd.c USB: host: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-atmel.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-dbg.c USB: ehci-hcd: no need to check return value of debugfs_create functions 2018-05-31 12:54:22 +02:00
ehci-exynos.c usb: host: exynos: Remove support for Exynos5440 2018-07-24 18:44:00 +02:00
ehci-fsl.c usb: add a flag to skip PHY initialization to struct usb_hcd 2018-03-09 09:43:52 -08:00
ehci-fsl.h USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-grlib.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-hcd.c usb: host: Replace empty define with do while 2018-09-28 15:03:37 +02:00
ehci-hub.c USB: ehci-hcd: Add get_resuming_ports method 2018-06-25 21:44:43 +08:00
ehci-mem.c Revert "usb: host: ehci: Use dma_pool_zalloc()" 2018-05-04 14:35:12 -07:00
ehci-mv.c USB: EHCI: ehci-mv: add DT support 2018-09-20 13:07:55 +02:00
ehci-mxc.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-npcm7xx.c USB: host: ehci-npcm7xx: Fix some error codes in probe 2018-06-28 19:32:42 +09:00
ehci-omap.c usb: ehci-omap: Fix deferred probe for phy handling 2018-12-17 14:07:59 +01:00
ehci-orion.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-pci.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-platform.c usb: host: ehci-platform: remove custom USB PHY handling 2018-03-09 09:43:53 -08:00
ehci-pmcmsp.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-ppc-of.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ehci-ps3.c powerpc/ps3: Set driver coherent_dma_mask 2018-07-20 12:50:37 +10:00
ehci-q.c usb: host: Replace empty define with do while 2018-09-28 15:03:37 +02:00
ehci-sched.c usb: host: ehci-sched: remove redundant pointer dev 2018-07-13 15:41:56 +02:00
ehci-sh.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-spear.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-st.c pinctrl: files should directly include apis they use 2018-02-05 09:41:54 -08:00
ehci-sysfs.c USB: move many drivers to use DEVICE_ATTR_RW 2018-01-24 08:49:51 +01:00
ehci-tegra.c usb: tegra: Move utmi-pads reset from ehci-tegra to tegra-phy 2018-04-23 09:50:57 +02:00
ehci-timer.c usb: host: Replace empty define with do while 2018-09-28 15:03:37 +02:00
ehci-w90x900.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci-xilinx-of.c USB: host: ehci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ehci.h usb: host: Replace empty define with do while 2018-09-28 15:03:37 +02:00
fhci-dbg.c USB: fhci-hcd: no need to check return value of debugfs_create functions 2018-05-31 12:54:22 +02:00
fhci-hcd.c USB: host: fhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
fhci-hub.c USB: host: fhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
fhci-mem.c USB: host: fhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
fhci-q.c USB: host: fhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
fhci-sched.c USB: host: fhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
fhci-tds.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
fhci.h USB: fhci-hcd: no need to check return value of debugfs_create functions 2018-05-31 12:54:22 +02:00
fotg210-hcd.c usb: host: Replace empty define with do while 2018-09-28 15:03:37 +02:00
fotg210.h usb: host: Replace empty define with do while 2018-09-28 15:03:37 +02:00
fsl-mph-dr-of.c USB: host: Remove redundant license text 2017-11-07 15:45:02 +01:00
hwa-hc.c USB: check usb_get_extra_descriptor for proper size 2018-12-05 21:20:14 +01:00
imx21-dbg.c USB: imx21-hcd: no need to check return value of debugfs_create functions 2018-05-31 12:54:22 +02:00
imx21-hcd.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
imx21-hcd.h USB: host: imx21: Remove redundant license text 2017-11-07 15:45:02 +01:00
isp116x-hcd.c USB: isp116x-hcd: no need to check return value of debugfs_create functions 2018-05-31 12:54:21 +02:00
isp116x.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
isp1362-hcd.c usb: host: isp1362-hcd: convert to DEFINE_SHOW_ATTRIBUTE 2018-12-12 12:38:41 +01:00
isp1362.h usb: isp1362: remove blackfin arch glue 2018-03-26 15:57:14 +02:00
Kconfig USB: EHCI: make ehci-mv a separate driver 2018-09-20 13:07:55 +02:00
Makefile USB: EHCI: make ehci-mv a separate driver 2018-09-20 13:07:55 +02:00
max3421-hcd.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-at91.c usb: host: ohci-at91: fix request of irq for optional gpio 2018-10-15 15:57:29 +02:00
ohci-da8xx.c USB: ohci: da8xx: remove clk con_id 2018-01-09 16:15:19 +01:00
ohci-dbg.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
ohci-exynos.c usb: host: exynos: Remove support for Exynos5440 2018-07-24 18:44:00 +02:00
ohci-hcd.c USB: ohci: no need to check return value of debugfs_create functions 2018-05-31 12:54:21 +02:00
ohci-hub.c ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() 2018-02-15 18:43:57 +01:00
ohci-mem.c usb: host: remove unnecessary condition check 2018-11-07 13:22:06 +01:00
ohci-nxp.c USB: host: ohci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ohci-omap.c usb: add a flag to skip PHY initialization to struct usb_hcd 2018-03-09 09:43:52 -08:00
ohci-pci.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-platform.c usb: host: ohci-platform: remove custom USB PHY handling 2018-03-09 09:43:53 -08:00
ohci-ppc-of.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-ps3.c powerpc/ps3: Set driver coherent_dma_mask 2018-07-20 12:50:37 +10:00
ohci-pxa27x.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-q.c usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() 2018-02-15 18:45:34 +01:00
ohci-s3c2410.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-sa1111.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-sm501.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ohci-spear.c USB: host: ohci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ohci-st.c USB: host: ohci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ohci-tmio.c USB: host: ohci: Remove redundant license text 2017-11-07 15:45:02 +01:00
ohci.h USB: ohci: no need to check return value of debugfs_create functions 2018-05-31 12:54:21 +02:00
oxu210hp-hcd.c treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
oxu210hp.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pci-quirks.c USB: OHCI: Remove USB bus reset delay from OHCI handover code 2018-09-10 20:05:02 +02:00
pci-quirks.h Revert "xhci: Reset Renesas uPD72020x USB controller for 32-bit DMA issue" 2018-06-01 13:24:51 +02:00
r8a66597-hcd.c usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() 2018-12-19 08:13:26 +01:00
r8a66597.h USB: host: Remove redundant license text 2017-11-07 15:45:02 +01:00
sl811_cs.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
sl811-hcd.c USB: host: sl811: Re-use DEFINE_SHOW_ATTRIBUTE() macro 2018-03-16 15:40:19 +01:00
sl811.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ssb-hcd.c USB: host: Remove redundant license text 2017-11-07 15:45:02 +01:00
u132-hcd.c usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() 2018-09-05 14:36:53 +02:00
uhci-debug.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
uhci-grlib.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
uhci-hcd.c USB: uhci: no need to check return value of debugfs_create functions 2018-05-31 12:54:21 +02:00
uhci-hcd.h usb: uhci: Add clk support to uhci-platform 2018-01-17 15:08:56 +01:00
uhci-hub.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
uhci-pci.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
uhci-platform.c usb: uhci: Add clk support to uhci-platform 2018-01-17 15:08:56 +01:00
uhci-q.c USB: remove the URB_NO_FSBR flag 2017-12-12 13:16:07 +01:00
xhci-dbg.c usb: xhci: Cleanup printk debug message for ERST 2017-12-08 17:43:52 +01:00
xhci-dbgcap.c Merge 4.18-rc5 into usb-next 2018-07-16 09:09:24 +02:00
xhci-dbgcap.h usb: xhci: dbc: Add SPDX identifiers to dbc files 2018-05-24 18:03:07 +02:00
xhci-dbgtty.c usb: xhci: dbc: Add SPDX identifiers to dbc files 2018-05-24 18:03:07 +02:00
xhci-debugfs.c xhci: debugfs: add debugfs interface to enable compliance mode for a port 2018-05-24 18:03:09 +02:00
xhci-debugfs.h USB: host: xhci-debugfs: add SPDX lines 2017-11-07 15:53:48 +01:00
xhci-ext-caps.c xhci: Add Intel extended cap / otg phy mux handling 2018-03-22 13:40:10 +01:00
xhci-ext-caps.h xhci: Add Intel extended cap / otg phy mux handling 2018-03-22 13:40:10 +01:00
xhci-histb.c xhci: Fix leaking USB3 shared_hcd at xhci removal 2018-11-09 08:31:08 -08:00
xhci-hub.c xhci: move usb2 get port status link resume handling to its own function 2018-12-07 15:40:41 +01:00
xhci-mem.c xhci: move bus_state structure under the xhci_hub structure. 2018-12-07 15:40:41 +01:00
xhci-mtk-sch.c usb: xhci-mtk: supports SSP without external USB3 gen2 hub 2018-09-28 15:04:45 +02:00
xhci-mtk.c xhci: Fix leaking USB3 shared_hcd at xhci removal 2018-11-09 08:31:08 -08:00
xhci-mtk.h usb: xhci-mtk: supports bandwidth scheduling with multi-TT 2018-09-28 15:04:45 +02:00
xhci-mvebu.c USB: host: xhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
xhci-mvebu.h USB: host: xhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
xhci-pci.c xhci: workaround CSS timeout on AMD SNPS 3.0 xHC 2018-12-06 13:00:10 +01:00
xhci-plat.c xhci: Fix leaking USB3 shared_hcd at xhci removal 2018-11-09 08:31:08 -08:00
xhci-plat.h USB: host: xhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
xhci-rcar.c usb: host: xhci-rcar: Add a condition check about PLL active 2018-07-06 16:37:19 +02:00
xhci-rcar.h USB: host: xhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
xhci-ring.c xhci: move bus_state structure under the xhci_hub structure. 2018-12-07 15:40:41 +01:00
xhci-tegra.c xhci: Fix leaking USB3 shared_hcd at xhci removal 2018-11-09 08:31:08 -08:00
xhci-trace.c USB: host: xhci: Remove redundant license text 2017-11-07 15:45:02 +01:00
xhci-trace.h xhci: Fix kernel oops in trace_xhci_free_virt_device 2018-06-25 21:16:27 +08:00
xhci.c Merge 4.20-rc6 into usb-next 2018-12-10 10:19:08 +01:00
xhci.h Merge 4.20-rc6 into usb-next 2018-12-10 10:19:08 +01:00