mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 22:54:01 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/dma
History
Sven Van Asbroeck 9b8a4a188a dmaengine: imx-sdma: fix use-after-free on probe error path 
[ Upstream commit 2b8066c3de ]

If probe() fails anywhere beyond the point where
sdma_get_firmware() is called, then a kernel oops may occur.

Problematic sequence of events:
1. probe() calls sdma_get_firmware(), which schedules the
   firmware callback to run when firmware becomes available,
   using the sdma instance structure as the context
2. probe() encounters an error, which deallocates the
   sdma instance structure
3. firmware becomes available, firmware callback is
   called with deallocated sdma instance structure
4. use after free - kernel oops !

Solution: only attempt to load firmware when we're certain
that probe() will succeed. This guarantees that the firmware
callback's context will remain valid.

Note that the remove() path is unaffected by this issue: the
firmware loader will increment the driver module's use count,
ensuring that the module cannot be unloaded while the
firmware callback is pending or running.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
[vkoul: fixed braces for if condition]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-08-04 09:33:14 +02:00
..
bestcomm dmaengine: NO_IRQ removal from powerpc-only drivers 2016-09-14 18:57:38 +05:30
dw dmaengine updates for 4.8-rc1 2016-10-06 17:13:54 -07:00
hsu dmaengine: hsu: refactor hsu_dma_do_irq() to return int 2016-09-15 21:15:40 +05:30
ioat driver/dma/ioat: Call del_timer_sync() without holding prep_lock 2018-11-13 11:16:53 -08:00
ipu dmaengine: ipu: Make sure the interrupt routine checks all interrupts. 2017-03-12 06:41:52 +01:00
ppc4xx Merge branch 'topic/unmap_cleanup' into for-linus 2016-10-03 09:36:11 +05:30
qcom dmaengine: qcom_hidma: assign channel cookie correctly 2019-04-05 22:29:14 +02:00
sh dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid 2019-05-02 09:32:02 +02:00
xilinx dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll 2019-02-12 19:44:52 +01:00
acpi-dma.c
amba-pl08x.c
at_hdmac.c dmaengine: at_hdmac: fix module unloading 2018-12-05 19:42:40 +01:00
at_hdmac_regs.h
at_xdmac.c dmaengine: at_xdmac: remove BUG_ON macro in tasklet 2019-05-31 06:48:18 -07:00
bcm2835-dma.c dmaengine: bcm2835: Fix abort of transactions 2019-02-12 19:45:00 +01:00
coh901318.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
coh901318.h
coh901318_lli.c dmaengine: coh901318: use NULL for pointer initialization 2016-09-26 22:28:24 +05:30
cppi41.c dmaengine: cppi41: delete channel from pending list when stop channel 2018-12-13 09:20:29 +01:00
dma-axi-dmac.c
dma-jz4740.c dmaengine: jz4740: disable/unprepare clk if probe fails 2018-02-25 11:05:49 +01:00
dma-jz4780.c dmaengine: dma-jz4780: Return error if not probed from DT 2018-11-13 11:16:53 -08:00
dmaengine.c dmaengine: Fix array index out of bounds warning in __get_unmap_pool() 2017-12-20 10:07:21 +01:00
dmaengine.h
dmatest.c dmaengine: dmatest: Abort test in case of mapping error 2019-03-13 14:05:00 -07:00
edma.c dmaengine: edma: Align the memcpy acnt array size with the transfer 2017-10-18 09:35:38 +02:00
ep93xx_dma.c dmaengine: ep93xx: Don't drain the transfers in terminate_all() 2017-06-14 15:05:57 +02:00
fsl-edma.c dmaengine: fsl-edma: disable clks on all error paths 2018-03-03 10:23:20 +01:00
fsl_raid.c dmaengine updates for 4.8-rc1 2016-10-06 17:13:54 -07:00
fsl_raid.h
fsldma.c Merge branch 'topic/unmap_cleanup' into for-linus 2016-10-03 09:36:11 +05:30
fsldma.h
idma64.c dmaengine: idma64: Use actual device for DMA transfers 2019-06-22 08:17:17 +02:00
idma64.h dmaengine: idma64: Use actual device for DMA transfers 2019-06-22 08:17:17 +02:00
img-mdc-dma.c dmaengine: img-mdc: fix a possible NULL dereference 2016-08-22 11:57:49 +05:30
imx-dma.c dmaengine: imx-dma: fix warning comparison of distinct pointer types 2019-04-05 22:29:14 +02:00
imx-sdma.c dmaengine: imx-sdma: fix use-after-free on probe error path 2019-08-04 09:33:14 +02:00
iop-adma.c
k3dma.c dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() 2018-08-24 13:12:33 +02:00
Kconfig dmaengine: mmp_tdma: add missing select GENERIC_ALLOCATOR in Kconfig 2016-10-18 20:32:56 +05:30
lpc18xx-dmamux.c
Makefile
mic_x100_dma.c
mic_x100_dma.h
mmp_pdma.c
mmp_tdma.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
moxart-dma.c dmaengine: moxart: remove NO_IRQ 2016-09-05 16:40:52 +05:30
mpc512x_dma.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
mv_xor.c Merge branch 'topic/unmap_cleanup' into for-linus 2016-10-03 09:36:11 +05:30
mv_xor.h dmaengine: mv_xor: Add support for IO (PCIe) src/dst areas 2016-09-15 21:13:59 +05:30
mv_xor_v2.c dmaengine: mv_xor_v2: kill the tasklets upon exit 2018-09-26 08:36:34 +02:00
mxs-dma.c Merge branch 'topic/no_irq' into for-linus 2016-10-03 09:18:29 +05:30
nbpfaxi.c
of-dma.c
omap-dma.c dmaengine: omap-dma: Fix dynamic lch_map allocation 2017-01-19 20:18:03 +01:00
pch_dma.c
pl330.c dmaengine: pl330: _stop: clear interrupt status 2019-05-31 06:48:15 -07:00
pxa_dma.c
s3c24xx-dma.c Merge branch 'topic/compile_test' into for-linus 2016-10-03 09:16:03 +05:30
sa11x0-dma.c dmaengine: sa11x0: use correct print specifiers for size_t 2016-09-26 22:29:26 +05:30
sirf-dma.c Merge branch 'topic/no_irq' into for-linus 2016-10-03 09:18:29 +05:30
ste_dma40.c Merge branch 'topic/ste_dma40' into for-linus 2016-10-03 09:35:55 +05:30
ste_dma40_ll.c
ste_dma40_ll.h
stm32-dma.c dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status 2017-12-09 22:01:50 +01:00
sun4i-dma.c
sun6i-dma.c dmaengine: sun6i: fix the uninitialized value for v_lli 2016-11-14 10:35:58 +05:30
tegra20-apb-dma.c dmaengine: tegra: avoid overflow of byte tracking 2019-04-05 22:29:15 +02:00
tegra210-adma.c dmaengine: tegra210-adma: use devm_clk_*() helpers 2019-05-31 06:48:30 -07:00
ti-dma-crossbar.c dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 2018-03-24 11:00:26 +01:00
timb_dma.c
TODO
txx9dmac.c
txx9dmac.h
virt-dma.c
virt-dma.h dmaengine: virt-dma: move function declarations 2016-10-01 11:41:39 +05:30
xgene-dma.c
zx296702_dma.c dmaengine: zx: fix build warning 2018-02-25 11:05:53 +01:00