kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Jeff Hugo 5f084993c9 bus: mhi: host: Fix race between unprepare and queue_buf 
commit 0686a818d7 upstream.

A client driver may use mhi_unprepare_from_transfer() to quiesce
incoming data during the client driver's tear down. The client driver
might also be processing data at the same time, resulting in a call to
mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs
after mhi_unprepare_from_transfer() has torn down the channel, a panic
will occur due to an invalid dereference leading to a page fault.

This occurs because mhi_gen_tre() does not verify the channel state
after locking it. Fix this by having mhi_gen_tre() confirm the channel
state is valid, or return error to avoid accessing deinitialized data.

Cc: stable@vger.kernel.org # 6.8
Fixes: b89b6a863d ("bus: mhi: host: Add spinlock to protect WP access when queueing TREs")
Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Troy Hanson <quic_thanson@quicinc.com>
Link: https://lore.kernel.org/r/20250306172913.856982-1-jeff.hugo@oss.qualcomm.com
[mani: added stable tag]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-04-25 10:45:26 +02:00
..
accel accel/qaic: Fix integer overflow in qaic_validate_req() 2025-03-28 21:59:54 +01:00
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:11:18 +02:00
acpi ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP 2025-04-10 14:37:42 +02:00
amba amba: bus: fix refcount leak 2023-08-22 15:50:57 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:11:41 +02:00
ata ahci: add PCI ID for Marvell 88SE9215 SATA Controller 2025-04-25 10:45:15 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:33:18 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:54:39 +02:00
base drivers: base: devres: Allow to release group on device release 2025-04-25 10:45:18 +02:00
bcma bcma: Add explicit of_device.h include 2023-04-14 15:32:56 +03:00
block zram: fix NULL pointer in comp_algorithm_show() 2025-03-22 12:50:37 -07:00
bluetooth Bluetooth: qca: simplify WCN399x NVM loading 2025-04-25 10:45:17 +02:00
bus bus: mhi: host: Fix race between unprepare and queue_buf 2025-04-25 10:45:26 +02:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-11-01 01:58:25 +01:00
cdx cdx: Fix possible UAF error in driver_override_show() 2025-03-13 12:58:36 +01:00
char tpm, tpm_tis: Fix timeout handling when waiting for TPM status 2025-04-25 10:45:23 +02:00
clk clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock 2025-04-10 14:37:32 +02:00
clocksource clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup 2025-04-25 10:45:25 +02:00
comedi comedi: Flush partial mappings in error case 2024-12-09 10:32:44 +01:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter counter: microchip-tcb-capture: Fix undefined counter channel state on probe 2025-04-07 10:06:37 +02:00
cpufreq cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() 2025-04-10 14:37:25 +02:00
cpuidle cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu 2025-01-17 13:36:16 +01:00
crypto crypto: hisilicon/sec2 - fix for aead auth key length 2025-04-10 14:37:32 +02:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:58:46 +01:00
dax dax: delete a stale directory pmem 2024-12-09 10:32:21 +01:00
dca Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:14:15 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-11-09 15:12:37 +01:00
dma dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister 2025-04-10 14:37:33 +02:00
dma-buf udmabuf: also check for F_SEAL_FUTURE_WRITE 2024-12-27 13:58:56 +01:00
edac EDAC/ie31200: Fix the error path order of ie31200_init() 2025-04-10 14:37:26 +02:00
eisa EISA: Replace all non-returning strlcpy with strscpy 2023-07-27 10:04:42 -07:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:12:27 +02:00
firewire firewire: core: correct range of block for case of switch statement 2024-10-04 16:29:28 +02:00
firmware firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success 2025-04-10 14:37:39 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:12:23 +02:00
fsi fsi: i2cr: Switch to use struct i2c_driver's .probe() 2023-08-22 15:51:33 +02:00
gnss driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
gpio gpio: rcar: Fix missing of_node_put() call 2025-03-13 12:58:33 +01:00
gpu drm/amdgpu: grab an additional reference on the gang fence v2 2025-04-25 10:45:20 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
hid HID: pidff: Fix null pointer dereference in pidff_find_fields 2025-04-25 10:45:12 +02:00
hsi hsi: omap_ssi: Explicitly include correct DT includes 2023-07-31 23:17:57 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:59:08 +01:00
hv Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio() 2025-03-22 12:50:38 -07:00
hwmon hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} 2025-04-10 14:37:38 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:54:43 +02:00
hwtracing coresight-etm4x: add isb() before reading the TRCSTATR 2025-04-10 14:37:32 +02:00
i2c i2c: omap: fix IRQ storms 2025-03-28 21:59:54 +01:00
i3c i3c: master: svc: Fix missing the IBI rules 2025-04-10 14:37:34 +02:00
idle intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly 2025-03-07 16:45:49 +01:00
iio iio: adc: ad7124: Fix comparison of channel configs 2025-04-10 14:37:33 +02:00
infiniband RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow 2025-04-10 14:37:31 +02:00
input Input: i8042 - swap old quirk combination with new quirk for more devices 2025-03-22 12:50:46 -07:00
interconnect interconnect: icc-clk: Add missed num_nodes initialization 2024-10-04 16:29:40 +02:00
iommu iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group 2025-04-25 10:45:09 +02:00
ipack tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
irqchip irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so 2025-02-17 09:40:38 +01:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-08-19 06:04:28 +02:00
leds leds: Fix LED_OFF brightness race 2025-04-10 14:37:32 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:54:02 +02:00
mailbox mailbox: tegra-hsp: Clear mailbox before using message 2025-02-17 09:40:38 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:20:05 +00:00
md dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature 2025-03-22 12:50:47 -07:00
media media: i2c: imx219: Rectify runtime PM handling in probe and remove 2025-04-25 10:45:25 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:37:38 +02:00
memstick memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove 2025-04-07 10:06:37 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-09 10:32:18 +01:00
mfd mfd: sm501: Switch to BIT() to mitigate integer overflows 2025-04-10 14:37:32 +02:00
misc eeprom: digsy_mtc: Make GPIO lookup table match the device 2025-03-13 12:58:37 +01:00
mmc mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves 2025-04-25 10:45:13 +02:00
most staging: most: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
mtd mtd: Replace kcalloc() with devm_kcalloc() 2025-04-25 10:45:25 +02:00
mux mux: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
net wifi: mt76: Add check for devm_kstrdup() 2025-04-25 10:45:25 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:28:28 +02:00
ntb ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() 2025-04-10 14:37:42 +02:00
nubus nubus: Don't list slot resources by default 2023-05-22 13:51:56 +02:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 20:00:13 +01:00
nvme nvmet-fcloop: swap list_add_tail arguments 2025-04-25 10:45:09 +02:00
nvmem nvmem: imx-ocotp-ele: fix MAC address byte order 2025-02-27 04:10:47 -08:00
of Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" 2025-03-13 12:58:22 +01:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-08 09:51:55 +01:00
parisc Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
parport parport: Proper fix for array out-of-bounds access 2024-10-22 15:46:33 +02:00
pci PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type 2025-04-25 10:45:19 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:11:31 +02:00
peci Update peci-next for v6.6-rc1 2023-08-08 10:53:30 +02:00
perf perf: arm_pmu: Don't disable counter in armpmu_add() 2025-04-25 10:45:10 +02:00
phy phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk 2025-03-07 16:45:47 +01:00
pinctrl pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() 2025-04-10 14:37:32 +02:00
platform platform/x86: ISST: Correct command storage data length 2025-04-10 14:37:42 +02:00
pmdomain pmdomain: imx8mp-blk-ctrl: add missing loop break condition 2025-01-23 17:21:17 +01:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:14:15 +00:00
power power: supply: max77693: Fix wrong conversion of charge input threshold value 2025-04-10 14:37:31 +02:00
powercap powercap: call put_device() on an error path in powercap_register_control_type() 2025-03-22 12:50:40 -07:00
pps pps: Fix a use-after-free 2025-02-08 09:52:38 +01:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: Ensure info->enable callback is always set 2025-02-17 09:40:41 +01:00
pwm pwm: fsl-ftm: Handle clk_get_rate() returning 0 2025-04-25 10:45:21 +02:00
rapidio rapidio: fix an API misues when rio_add_net() fails 2025-03-13 12:58:27 +01:00
ras ras/debugfs: Fix error checking for debugfs_create_dir() 2023-05-16 21:12:23 +02:00
regulator regulator: check that dummy regulator has been probed before using it 2025-03-28 21:59:54 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Handle platforms with one power domain 2025-04-10 14:37:31 +02:00
reset reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC 2025-04-07 10:06:36 +02:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-09 10:32:29 +01:00
rtc rtc: zynqmp: Fix optional clock name property 2025-02-17 09:40:41 +01:00
s390 s390/cio: Fix CHPID "configure" attribute caching 2025-03-22 12:50:42 -07:00
sbus sbus: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
scsi scsi: st: Fix array overflow in st_setup() 2025-04-25 10:45:16 +02:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-09 10:33:00 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:58:37 +01:00
soc soc: qcom: pdr: Fix the potential deadlock 2025-03-28 21:59:55 +01:00
soundwire soundwire: slave: fix an OF node reference leak in soundwire slave device 2025-04-10 14:37:32 +02:00
spi spi: cadence-qspi: Fix probe on AM62A LP SK 2025-04-25 10:45:23 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:38:40 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:33:22 +02:00
staging staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES 2025-04-10 14:37:34 +02:00
target scsi: target: spc: Fix RSOC parameter data header size 2025-04-25 10:45:14 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: Fix supplicant wait loop 2025-02-27 04:10:51 -08:00
thermal thermal: int340x: Add NULL check for adev 2025-04-10 14:37:26 +02:00
thunderbolt thunderbolt: Don't display nvm_version unless upgrade supported 2025-01-09 13:31:49 +01:00
tty tty: n_tty: use uint for space returned by tty_write_room() 2025-04-10 14:37:34 +02:00
ufs scsi: ufs: qcom: Only free platform MSIs when ESI is enabled 2025-04-07 10:06:36 +02:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:11:41 +02:00
usb usb: xhci: correct debug message page size calculation 2025-04-10 14:37:33 +02:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-09 10:32:30 +01:00
vfio Revert "vfio/platform: check the bounds of read/write syscalls" 2025-02-21 13:57:27 +01:00
vhost vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint 2025-04-10 14:37:32 +02:00
video fbdev: omapfb: Add 'plane' value check 2025-04-25 10:45:20 +02:00
virt drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl 2025-03-13 12:58:37 +01:00
virtio virtio_ring: fix KMSAN error for premapped mode 2024-09-12 11:11:36 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe() 2025-02-08 09:52:25 +01:00
xen xenfs/xensyms: respect hypervisor's "next" indication 2025-04-25 10:45:22 +02:00
zorro zorro: Include zorro.h in names.c 2023-08-21 13:27:44 +02:00
Kconfig Merge patch series "Add non-coherent DMA support for AX45MP" 2023-09-08 11:24:34 -07:00
Makefile pmdomain: Rename the genpd subsystem to pmdomain 2023-09-13 11:09:21 +02:00