mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-28 15:20:41 +00:00
Code Issues Releases Wiki Activity
No description
732622 commits 105 branches 5124 tags 5.7 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Find a file
Pavel Skripkin 62bc1ea5c7 ath9k: fix use-after-free in ath9k_hif_usb_rx_cb 
[ Upstream commit 0ac4827f78 ]

Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.

Probable call trace which can trigger use-after-free:

ath9k_htc_probe_device()
  /* htc_handle->drv_priv = priv; */
  ath9k_htc_wait_for_target()      <--- Failed
  ieee80211_free_hw()		   <--- priv pointer is freed

<IRQ>
...
ath9k_hif_usb_rx_cb()
  ath9k_hif_usb_rx_stream()
   RX_STAT_INC()		<--- htc_handle->drv_priv access

In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]

Link: https://syzkaller.appspot.com/bug?id=6ead44e37afb6866ac0c7dd121b4ce07cb665f60 [0]
Link: https://syzkaller.appspot.com/bug?id=b8101ffcec107c0567a0cd8acbbacec91e9ee8de [1]
Fixes: fb9987d0f7 ("ath9k_htc: Support for AR9271 chipset.")
Reported-and-tested-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.1655145743.git.paskripkin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-25 11:11:16 +02:00
arch arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node 2022-08-25 11:11:15 +02:00
block block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern 2022-06-06 08:20:57 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-25 11:46:44 +02:00
crypto crypto: drbg - make reseeding from get_random_bytes() synchronous 2022-06-25 11:46:41 +02:00
Documentation ipv4: Fix data-races around sysctl_ip_dynaddr. 2022-07-21 20:42:45 +02:00
drivers ath9k: fix use-after-free in ath9k_hif_usb_rx_cb 2022-08-25 11:11:16 +02:00
firmware Fix built-in early-load Intel microcode alignment 2020-01-23 08:20:30 +01:00
fs ext2: Add more validity checks for inode counts 2022-08-25 11:11:14 +02:00
include USB: HCD: Fix URB giveback issue in tasklet function 2022-08-25 11:11:13 +02:00
init random: handle latent entropy and command line from random_init() 2022-06-25 11:46:40 +02:00
ipc ipc: WARN if trying to remove ipc object which is absent 2021-12-08 08:46:53 +01:00
kernel PM: hibernate: defer device probing when resuming from hibernation 2022-08-25 11:11:14 +02:00
lib ida: don't use BUG_ON() for debugging 2022-07-12 16:27:29 +02:00
mm mm/mempolicy: fix uninit-value in mpol_rebind_policy() 2022-07-29 17:06:50 +02:00
net netfilter: nf_tables: fix null deref due to zeroed list head 2022-08-25 11:11:13 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-26 11:40:31 +01:00
scripts modpost: fix section mismatch check for exported init/exit sections 2022-07-02 16:18:10 +02:00
security selinux: Add boundary check in put_entry() 2022-08-25 11:11:14 +02:00
sound ALSA: hda/cirrus - support for iMac 12,1 model 2022-08-25 11:11:11 +02:00
tools thermal/tools/tmon: Include pthread and time headers in tmon.h 2022-08-25 11:11:16 +02:00
usr initramfs: restore default compression behavior 2020-04-13 10:34:19 +02:00
virt KVM: Prevent module exit until all VMs are freed 2022-04-20 09:08:24 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: rpm-pkg: keep spec file until make mrproper 2018-02-13 10:19:46 +01:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS MAINTAINERS: co-maintain random.c 2022-06-25 11:46:29 +02:00
Makefile Makefile: link with -z noexecstack --no-warn-rwx-segments 2022-08-25 11:11:10 +02:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.