Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Arend Van Spriel 4a70f07da8 brcmfmac: change driver unbind order of the sdio function devices ... commit 5c3de777bd upstream. In the function brcmf_sdio_firmware_callback() the driver is unbound from the sdio function devices in the error path. However, the order in which it is done resulted in a use-after-free issue (see brcmf_ops_sdio_remove() in bcmsdh.c). Hence change the order and first unbind sdio function #2 device and then unbind sdio function #1 device. Fixes: 7a51461fc2 ("brcmfmac: unbind all devices upon failure in firmware callback") Reported-by: Stefan Wahren <stefan.wahren@i2se.com> Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2017-12-14 09:28:13 +01:00
..
accessibility	printk: move braille console support into separate braille.[ch] files	2013-07-31 14:41:03 -07:00
acpi	ACPI / EC: Fix regression related to triggering source of EC event handling	2017-11-30 08:39:01 +00:00
amba	ARM: 8596/1: amba: Support clk parents and rates assigned in DT	2016-08-12 16:47:07 +01:00
android	ANDROID: binder: fix proc->tsk check.	2017-08-30 10:21:53 +02:00
ata	ata: fixes kernel crash while tracing ata_eh_link_autopsy event	2017-11-30 08:39:04 +00:00
atm	atm: fix improper return value	2016-12-05 14:53:46 -05:00
auxdisplay	auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches	2017-03-30 09:41:27 +02:00
base	isa: Prevent NULL dereference in isa_bus driver callbacks	2017-12-14 09:28:11 +01:00
bcma	bcma: use (get|put)_device when probing/removing device driver	2017-03-12 06:41:52 +01:00
block	rbd: use GFP_NOIO for parent stat and data requests	2017-11-15 15:53:20 +01:00
bluetooth	Bluetooth: btusb: fix QCA Rome suspend/resume	2017-11-21 09:23:21 +01:00
bus	bus: mbus: fix window size calculation for 4GB windows	2017-10-27 10:38:08 +02:00
cdrom	cdrom: support read sub-channel command in LBA format	2016-07-12 08:24:50 -07:00
char	ipmi: fix unsigned long underflow	2017-11-24 08:33:42 +01:00
clk	clk: qcom: ipq4019: Add all the frequencies for apss cpu	2017-11-30 08:39:13 +00:00
clocksource	clockevents/drivers/cs5535: Improve resilience to spurious interrupts	2017-10-27 10:38:08 +02:00
connector	connector: make cn_proc explicitly non-modular	2016-07-05 11:40:47 -07:00
cpufreq	cpufreq: Do not clear real_cpus mask on policy init	2017-11-08 10:08:33 +01:00
cpuidle	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus	2016-10-15 09:26:12 -07:00
crypto	Revert "crypto: caam - get rid of tasklet"	2017-12-09 22:01:46 +01:00
dax	device-dax: fix sysfs duplicate warnings	2017-08-06 18:59:43 -07:00
dca	dmaengine: ioatdma: constify dca_ops structures	2015-11-16 09:27:32 +05:30
devfreq	PM / devfreq: Fix memory leak when fail to register device	2017-09-27 14:39:24 +02:00
dio	m68k: don't export static inline functions	2009-12-06 11:18:28 +01:00
dma	dmaengine: pl330: fix double lock	2017-12-09 22:01:53 +01:00
dma-buf	dma-buf: Update kerneldoc for sync_file_create	2017-12-09 22:01:56 +01:00
edac	EDAC, sb_edac: Fix missing break in switch	2017-12-09 22:01:49 +01:00
eisa	Revert "EISA: Initialize device before its resources"	2014-01-17 14:57:29 -07:00
extcon	extcon: palmas: Check the parent instance to prevent the NULL	2017-11-21 09:23:21 +01:00
firewire	firewire: net: fix fragmented datagram_size off-by-one	2016-11-03 14:46:39 +01:00
firmware	efi/esrt: Use memunmap() instead of kfree() to free the remapping	2017-12-14 09:28:11 +01:00
fmc	Merge 3.14-rc5 into char-misc-next	2014-03-02 19:53:09 -08:00
fpga	fpga manager: Add hardware dependency to Zynq driver	2016-09-08 17:31:44 +02:00
gpio	gpio: mockup: dynamically allocate memory for chip name	2017-11-30 08:39:13 +00:00
gpu	drm/amdgpu: fix unload driver issue for virtual display	2017-12-09 22:01:53 +01:00
hid	HID: usbhid: fix out-of-bounds bug	2017-10-18 09:35:38 +02:00
hsi	HSI: omap_ssi: drop pm_runtime_irq_safe	2016-06-28 00:40:08 +02:00
hv	Drivers: hv: fcopy: restore correct transfer length	2017-10-12 11:51:24 +02:00
hwmon	hwmon: (jc42) optionally try to disable the SMBUS timeout	2017-12-05 11:24:34 +01:00
hwspinlock	hwspinlock: qcom_hwspinlock: add missing of_node_put after calling of_parse_phandle	2016-07-06 12:20:34 -07:00
hwtracing	stm class: Fix a use-after-free	2017-10-12 11:51:24 +02:00
i2c	i2c: i2c-cadence: Initialize configuration before probing devices	2017-12-09 22:01:53 +01:00
ide	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide	2016-07-29 13:29:06 -07:00
idle	x86/intel_idle: Add CPU model 0x4a (Atom Z34xx series)	2017-04-12 12:41:17 +02:00
iio	iio: adc: ti-ads1015: add 10% to conversion wait time	2017-12-09 22:01:49 +01:00
infiniband	RDMA/qedr: Fix RDMA CM loopback	2017-12-09 22:01:53 +01:00
input	Input: ims-psu - check if CDC union descriptor is sane	2017-11-18 11:22:24 +01:00
iommu	iommu/vt-d: Fix scatterlist offset handling	2017-12-14 09:28:13 +01:00
ipack	ipack: print a hex number after a 0x prefix	2016-10-27 18:43:43 -07:00
irqchip	irqchip/gic-v3: Fix ppi-partitions lookup	2017-11-30 08:39:06 +00:00
isdn	isdn/i4l: fetch the ppp_write buffer in one shot	2017-10-12 11:51:21 +02:00
leds	Revert "leds: handle suspend/resume in heartbeat trigger"	2017-08-30 10:21:51 +02:00
lguest	Merge branch 'x86/urgent' into x86/asm to pick up dependent fixes	2016-04-13 11:36:44 +02:00
lightnvm	Merge branch 'for-4.9/block' of git://git.kernel.dk/linux-block	2016-10-07 14:42:05 -07:00
macintosh	powerpc: Remove all usages of NO_IRQ	2016-09-20 20:57:12 +10:00
mailbox	mailbox: handle empty message in tx_tick	2017-08-06 18:59:42 -07:00
mcb	MCB: add support for SC31 to mcb-lpc	2017-09-09 17:39:41 +02:00
md	bcache: recover data from backing when data is clean	2017-12-09 22:01:46 +01:00
media	media: v4l2-ctrl: Fix flags field on Control events	2017-11-30 08:39:09 +00:00
memory	memory/atmel-ebi: Fix ns <-> cycles conversions	2017-03-15 10:02:45 +08:00
memstick	memstick: rtsx_usb_ms: Manage runtime PM when accessing the device	2016-10-17 15:43:05 +02:00
message	scsi: fusion: Fix error return code in mptfc_probe()	2016-09-14 14:26:19 -04:00
mfd	mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot	2017-12-05 11:24:32 +01:00
misc	eeprom: at24: check at24_read/write arguments	2017-12-05 11:24:34 +01:00
mmc	mmc: sdhci-msm: fix issue with power irq	2017-12-09 22:01:48 +01:00
mtd	mtd: nand: mtk: fix infinite ECC decode IRQ issue	2017-11-30 08:39:06 +00:00
net	brcmfmac: change driver unbind order of the sdio function devices	2017-12-14 09:28:13 +01:00
nfc	nfc: fdp: fix NULL pointer dereference	2017-08-06 18:59:42 -07:00
ntb	ntb: transport shouldn't disable link due to bogus values in SPADs	2017-08-30 10:21:55 +02:00
nubus	nubus: Remove superfluous interrupt disable/restore	2014-10-27 11:03:19 +01:00
nvdimm	libnvdimm, namespace: make 'resource' attribute only readable by root	2017-11-30 08:39:07 +00:00
nvme	nvmet: cancel fatal error and flush async work before free controller	2017-12-09 22:01:54 +01:00
nvmem	nvmem: imx-ocotp: Fix wrong register size	2017-08-06 18:59:48 -07:00
of	of: device: Export of_device_{get_modalias, uvent_modalias} to modules	2017-07-27 15:08:08 -07:00
oprofile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-10 20:16:43 -07:00
parisc	parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo	2017-08-24 17:12:18 -07:00
parport	parisc, parport_gsc: Fixes for printk continuation lines	2017-06-17 06:41:54 +02:00
pci	PCI: Apply _HPX settings only to relevant devices	2017-11-30 08:39:10 +00:00
pcmcia	pcmcia: fix return value of soc_pcmcia_regulator_set	2016-11-11 08:45:08 -08:00
perf	perf: xgene: Remove bogus IS_ERR() check	2016-10-17 15:50:07 +01:00
phy	phy: qcom-usb-hs: Add depends on EXTCON	2017-05-14 14:00:19 +02:00
pinctrl	pinctrl: sirf: atlas7: Add missing 'of_node_put()'	2017-11-30 08:39:12 +00:00
platform	platform/x86: hp-wmi: Do not shadow error values	2017-11-15 15:53:17 +01:00
pnp	PNP: isapnp: make core more explicitly non-modular	2016-08-16 22:53:59 +02:00
power	power: supply: axp288_fuel_gauge: Read 12 bit values 2 registers at a time	2017-11-21 09:23:25 +01:00
powercap	powercap/intel_rapl: fix and tidy up error handling	2017-01-19 20:18:07 +01:00
pps	pps: kc: fix non-tickless system config dependency	2016-10-11 15:06:32 -07:00
ps3	powerpc: Remove all usages of NO_IRQ	2016-09-20 20:57:12 +10:00
ptp	drivers/ptp: Fix kernel memory disclosure	2016-10-13 10:20:06 -04:00
pwm	pwm: rockchip: State of PWM clock should synchronize with PWM enabled state	2017-04-21 09:31:22 +02:00
rapidio	drivers/rapidio/devices/tsi721.c: make module parameter variable name unique	2017-10-08 10:26:09 +02:00
ras	x86/ras: Move AMD MCE injector to arch/x86/ras/	2015-08-13 10:12:54 +02:00
regulator	regulator: fan53555: fix I2C device ids	2017-11-02 09:49:15 +01:00
remoteproc	remoteproc: qcom: mdt_loader: Don't overwrite firmware object	2017-03-12 06:41:50 +01:00
reset	reset: ti_syscon: fix a ti_syscon_reset_status issue	2017-10-08 10:26:03 +02:00
rpmsg	rpmsg: virtio_rpmsg_bus: fix channel creation	2017-01-26 08:24:44 +01:00
rtc	rtc: rx8010: change lock mechanism	2017-11-21 09:23:25 +01:00
s390	s390/qeth: issue STARTLAN as first IPA command	2017-11-15 15:53:16 +01:00
sbus	openprom: fix warning	2016-05-20 18:33:37 -07:00
scsi	scsi: use dma_get_cache_alignment() as minimum DMA alignment	2017-12-14 09:28:11 +01:00
sfi	SFI: fix compiler warnings	2014-12-03 18:49:20 -05:00
sh	drivers: sh: Stop using the legacy clock domain on ARM	2016-05-30 09:41:11 +09:00
sn	Drivers: misc: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
soc	soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe()	2017-01-26 08:24:45 +01:00
spi	spi: spi-axi: fix potential use-after-free after deregistration	2017-12-09 22:01:48 +01:00
spmi	spmi: Include OF based modalias in device uevent	2017-07-27 15:08:08 -07:00
ssb	ssb: Fix error routine when fallback SPROM fails	2017-01-09 08:32:16 +01:00
staging	cec: initiator should be the same as the destination for, poll	2017-12-09 22:01:54 +01:00
target	target: Fix QUEUE_FULL + SCSI task attribute handling	2017-11-30 08:39:06 +00:00
tc	TC: Error handling clean-ups	2014-11-24 07:45:25 +01:00
thermal	thermal: cpu_cooling: Avoid accessing potentially freed structures	2017-07-27 15:07:55 -07:00
thunderbolt	thunderbolt: Don't declare Falcon Ridge unsupported	2016-08-31 13:25:02 +02:00
tty	sysrq : fix Show Regs call trace on ARM	2017-12-09 22:01:49 +01:00
uio	uio: fix dmem_region_start computation	2016-08-31 13:07:30 +02:00
usb	usb: gadget: udc: renesas_usb3: fix number of the pipes	2017-12-14 09:28:09 +01:00
uwb	uwb: ensure that endpoint is interrupt	2017-10-12 11:51:19 +02:00
vfio	vfio/spapr: Fix missing mutex unlock when creating a window	2017-12-09 22:01:54 +01:00
vhost	fix a page leak in vhost_scsi_iov_to_sgl() error recovery	2017-11-30 08:39:05 +00:00
video	backlight: adp5520: Fix error handling in adp5520_bl_probe()	2017-11-21 09:23:25 +01:00
virt	mm: replace get_user_pages() write/force parameters with gup_flags	2016-10-19 08:11:43 -07:00
virtio	virtio: release virtio index when fail to device_register	2017-12-14 09:28:10 +01:00
vlynq	drivers/vlynq/vlynq.c: fix another resource size off by 1 error	2014-01-23 16:36:55 -08:00
vme	VME: restore bus_remove function causing incomplete module unload	2017-03-12 06:41:50 +01:00
w1	w1: ds2490: USB transfer buffers need to be DMAable	2017-03-12 06:41:48 +01:00
watchdog	watchdog: kempld: fix gcc-4.3 build	2017-10-21 17:21:33 +02:00
xen	xen: xenbus driver must not accept invalid transaction ids	2017-11-30 08:39:15 +00:00
zorro	zorro: Use kobj_to_dev()	2016-01-25 09:42:23 +01:00
Kconfig	libnvdimm for 4.7	2016-05-23 11:18:01 -07:00
Makefile	usb: Make sure usb/phy/of gets built-in	2017-05-20 14:28:35 +02:00