mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 23:27:06 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/usb/host
History
Jia-Ju Bai 8b22ef6610 usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() 
commit c85400f886 upstream.

The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
be concurrently executed.
The two functions both access a possible shared variable "hep->hcpriv".

This shared variable is freed by r8a66597_endpoint_disable() via the
call path:
r8a66597_endpoint_disable
  kfree(hep->hcpriv) (line 1995 in Linux-4.19)

This variable is read by r8a66597_urb_enqueue() via the call path:
r8a66597_urb_enqueue
  spin_lock_irqsave(&r8a66597->lock)
  init_pipe_info
    enable_r8a66597_pipe
      pipe = hep->hcpriv (line 802 in Linux-4.19)

The read operation is protected by a spinlock, but the free operation
is not protected by this spinlock, thus a concurrency use-after-free bug
may occur.

To fix this bug, the spin-lock and spin-unlock function calls in
r8a66597_endpoint_disable() are moved to protect the free operation.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-09 16:16:43 +01:00
..
whci whci: Remove deprecated create_singlethread_workqueue 2016-08-15 16:25:58 +02:00
bcma-hcd.c USB: bcma: drop Northstar PHY 2.0 initialization code 2016-09-27 12:20:17 +02:00
ehci-atmel.c usb: ehci-atmel: use __maybe_unused to hide pm functions 2016-03-03 20:37:41 -08:00
ehci-dbg.c usb: host: fix incorrect updating of offset 2017-12-09 22:01:57 +01:00
ehci-exynos.c usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths 2017-05-14 14:00:18 +02:00
ehci-fsl.c drivers/usb/host/fsl: Port USB EHCI host driver for LS102xA 2016-01-24 20:37:47 -08:00
ehci-fsl.h
ehci-grlib.c
ehci-hcd.c USB: host: ehci-sead3: Remove SEAD-3 EHCI code 2016-10-05 01:31:20 +02:00
ehci-hub.c USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN 2016-06-01 14:56:24 -07:00
ehci-mem.c
ehci-msm.c usb: host: ehci-msm: Conditionally call ehci suspend/resume 2016-06-07 22:15:25 -07:00
ehci-mv.c
ehci-mxc.c
ehci-omap.c usb/host/: const data must use __initconst not __initdata 2016-04-28 12:35:36 -07:00
ehci-orion.c
ehci-pci.c ehci-hcd: Disable memory-write-invalidate when the driver is removed 2016-01-24 20:51:34 -08:00
ehci-platform.c usb: ehci-platform: increase EHCI_MAX_RSTS to 4 2016-10-24 14:29:08 +02:00
ehci-pmcmsp.c
ehci-ppc-of.c
ehci-ps3.c
ehci-q.c USB: EHCI: improvements to unlink_empty_async_suspended() 2016-02-03 13:14:52 -08:00
ehci-sched.c usb: host: ehci-sched: remove unnecessary braces 2016-02-03 13:44:05 -08:00
ehci-sh.c
ehci-spear.c usb/host/: const data must use __initconst not __initdata 2016-04-28 12:35:36 -07:00
ehci-st.c usb: host: ehci-st: Inform the reset framework that our reset line may be shared 2016-06-30 07:44:21 +01:00
ehci-sysfs.c
ehci-tegra.c usb: host: ehci-tegra: Avoid getting the same reset twice 2016-06-07 22:15:25 -07:00
ehci-tilegx.c
ehci-timer.c USB: EHCI: add a delay when unlinking an active QH 2016-02-03 13:14:52 -08:00
ehci-w90x900.c
ehci-xilinx-of.c
ehci.h usb: host: unhide suspend/resume declarations 2016-03-03 20:37:41 -08:00
fhci-dbg.c
fhci-hcd.c usb: host: fhci-hcd: don't print on ENOMEM 2016-08-30 19:17:37 +02:00
fhci-hub.c QE: Move QE from arch/powerpc to drivers/soc 2015-12-22 17:12:56 -06:00
fhci-mem.c
fhci-q.c
fhci-sched.c USB: FHCI: avoid redundant condition 2016-05-09 13:08:46 +02:00
fhci-tds.c usb: whci: fhci: remove comparison to bool 2015-12-04 08:25:58 -08:00
fhci.h QE: Move QE from arch/powerpc to drivers/soc 2015-12-22 17:12:56 -06:00
fotg210-hcd.c usb/host/fotg210: remove dead code in create_sysfs_files 2016-05-09 13:08:46 +02:00
fotg210.h
fsl-mph-dr-of.c usb: host: fsl-mph-dr-of: use of_property_read_bool 2016-08-09 15:49:01 +02:00
hwa-hc.c USB: check usb_get_extra_descriptor for proper size 2018-12-13 09:20:27 +01:00
imx21-dbg.c
imx21-hcd.c
imx21-hcd.h
isp116x-hcd.c
isp116x.h
isp1362-hcd.c
isp1362.h
Kconfig usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT 2018-02-22 15:43:51 +01:00
Makefile usb: xhci: Add NVIDIA Tegra XUSB controller driver 2016-04-29 16:48:58 +02:00
max3421-hcd.c usb: host: max3421-hcd: don't print on ENOMEM 2016-08-30 19:17:37 +02:00
ohci-at91.c usb: ohci-at91: Do not drop unhandled USB suspend control requests 2017-03-18 19:14:31 +08:00
ohci-da8xx.c
ohci-dbg.c
ohci-exynos.c usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths 2017-05-14 14:00:18 +02:00
ohci-hcd.c USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM 2018-05-25 16:13:01 +02:00
ohci-hub.c ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() 2018-02-28 10:18:31 +01:00
ohci-mem.c
ohci-nxp.c usb: ohci: nxp: remove USB PLL and USB OTG clock management 2016-03-03 20:38:53 -08:00
ohci-omap.c USB: ohci-omap - avoid including mach/irqs.h 2016-08-30 19:31:33 +02:00
ohci-omap3.c
ohci-pci.c ohci-pci: add qemu quirk 2017-05-25 15:44:36 +02:00
ohci-platform.c ohci-platform: Add support for controllers with multiple reset lines 2016-06-07 22:21:41 -07:00
ohci-ppc-of.c
ohci-ps3.c
ohci-pxa27x.c usb: host: ohci-pxa27x: propagate the irq error code 2016-02-14 17:06:43 -08:00
ohci-q.c usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() 2018-02-28 10:18:31 +01:00
ohci-s3c2410.c
ohci-sa1111.c usb: ohci-sa1111: remove mach/hardware.h include 2016-08-30 19:24:59 +02:00
ohci-sm501.c
ohci-spear.c
ohci-st.c usb: host: ohci-st: Inform the reset framework that our reset line may be shared 2016-06-30 07:44:20 +01:00
ohci-tilegx.c
ohci-tmio.c
ohci.h ohci-pci: add qemu quirk 2017-05-25 15:44:36 +02:00
oxu210hp-hcd.c usb: host: oxu210hp-hcd: use list_for_each_entry_safe 2016-01-24 20:55:33 -08:00
oxu210hp.h
pci-quirks.c xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround 2017-10-12 11:51:18 +02:00
pci-quirks.h xhci: Bad Ethernet performance plugged in ASM1042A host 2017-07-27 15:08:01 -07:00
r8a66597-hcd.c usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() 2019-01-09 16:16:43 +01:00
r8a66597.h
sl811-hcd.c
sl811.h
sl811_cs.c
ssb-hcd.c
u132-hcd.c usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() 2018-09-26 08:36:36 +02:00
uhci-debug.c new helpers: no_seek_end_llseek{,_size}() 2015-12-23 10:41:31 -05:00
uhci-grlib.c
uhci-hcd.c usb: host: uhci-hcd: don't print on ENOMEM 2016-08-30 19:17:37 +02:00
uhci-hcd.h
uhci-hub.c
uhci-pci.c USB: UHCI: report non-PME wakeup signalling for Intel hardware 2017-01-06 10:40:11 +01:00
uhci-platform.c
uhci-q.c
xhci-dbg.c usb: host: xhci-dbg: HCIVERSION should be a binary number 2017-03-18 19:14:32 +08:00
xhci-ext-caps.h xhci: harden xhci_find_next_ext_cap against device removal 2016-02-04 17:00:10 -08:00
xhci-hub.c xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only 2018-12-29 13:40:14 +01:00
xhci-mem.c xhci: xhci-mem: off by one in xhci_stream_id_to_ring() 2018-07-17 11:37:53 +02:00
xhci-mtk-sch.c usb: xhci-mtk: fix bpkts value of LS/HS periodic eps not behind TT 2016-02-03 14:01:47 -08:00
xhci-mtk.c usb: xhci-mtk: resume USB3 roothub first 2018-10-13 09:18:55 +02:00
xhci-mtk.h
xhci-mvebu.c usb: host: xhci: plat: change type of mvebu init_quirk() 2016-04-26 16:08:02 -07:00
xhci-mvebu.h usb: host: xhci: plat: change type of mvebu init_quirk() 2016-04-26 16:08:02 -07:00
xhci-pci.c xhci: Add missing CAS workaround for Intel Sunrise Point xHCI 2018-10-13 09:18:55 +02:00
xhci-plat.c Revert "xhci: plat: Register shutdown for xhci_plat" 2018-04-13 19:48:37 +02:00
xhci-plat.h usb: host: xhci: plat: finally get rid of xhci_plat_type_is() 2016-04-26 16:08:02 -07:00
xhci-rcar.c usb: host: xhci: rcar: retire use of xhci_plat_type_is() 2016-04-26 16:08:02 -07:00
xhci-rcar.h
xhci-ring.c usb: xhci: fix uninitialized completion when USB3 port got wrong status 2018-12-01 09:44:25 +01:00
xhci-tegra.c usb: xhci: remove the code build warning 2018-08-24 13:12:32 +02:00
xhci-trace.c
xhci-trace.h
xhci.c xhci: Prevent U1/U2 link pm states if exit latency is too long 2018-12-13 09:20:29 +01:00
xhci.h usb: xhci: fix timeout for transition from RExit to U0 2018-12-01 09:44:18 +01:00