mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-15 07:04:44 +00:00
Code Issues Releases Wiki Activity
No description
1060987 commits 104 branches 5093 tags 5.5 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Find a file
Zheng Wang 1e58fb6b1c usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition 
[ Upstream commit 2b947f8769 ]

In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.
renesas_usb3_start will be called to start the work.

If we remove the driver which will call usbhs_remove, there may be
an unfinished work. The possible sequence is as follows:

CPU0                  			CPU1

                    			 renesas_usb3_role_work
renesas_usb3_remove
usb_role_switch_unregister
device_unregister
kfree(sw)
//free usb3->role_sw
                    			 usb_role_switch_set_role
                    			 //use usb3->role_sw

The usb3->role_sw could be freed under such circumstance and then
used in usb_role_switch_set_role.

This bug was found by static analysis. And note that removing a
driver is a root-only operation, and should never happen in normal
case. But the root user may directly remove the device which
will also trigger the remove function.

Fix it by canceling the work before cleanup in the renesas_usb3_remove.

Fixes: 39facfa01c ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-11 23:00:32 +09:00
arch arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-05-11 23:00:24 +09:00
block blk-crypto: make blk_crypto_evict_key() more robust 2023-05-11 23:00:16 +09:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto crypto: drbg - Only fail when jent is unavailable in FIPS mode 2023-05-11 23:00:27 +09:00
Documentation riscv: Move early dtb mapping into the fixmap region 2023-05-01 08:23:24 +09:00
drivers usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition 2023-05-11 23:00:32 +09:00
fs pstore: Revert pmsg_lock back to a normal mutex 2023-05-11 23:00:31 +09:00
include netfilter: nf_tables: don't write table validation state without mutex 2023-05-11 23:00:30 +09:00
init kbuild: Add CONFIG_PAHOLE_VERSION 2023-02-25 12:06:45 +01:00
io_uring io_uring: avoid null-ptr-deref in io_arm_poll_handler 2023-03-22 13:31:37 +01:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel bpf: Don't EFAULT for getsockopt with optval=NULL 2023-05-11 23:00:30 +09:00
lib debugobject: Prevent init race with static objects 2023-05-11 23:00:25 +09:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs 2023-05-11 23:00:18 +09:00
net tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. 2023-05-11 23:00:31 +09:00
samples samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() 2022-12-31 13:14:31 +01:00
scripts ASN.1: Fix check for strdup() success 2023-04-26 13:51:56 +02:00
security selinux: ensure av_permissions.h is built when needed 2023-05-11 23:00:19 +09:00
sound sound/oss/dmasound: fix build when drivers are mixed =y/=m 2023-05-11 23:00:19 +09:00
tools selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach 2023-05-11 23:00:28 +09:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: fix memoryleak in kvm_init() 2023-03-17 08:49:04 +01:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS counter: Internalize sysfs interface code 2023-04-20 12:13:55 +02:00
Makefile Linux 5.15.110 2023-05-01 08:23:24 +09:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.