kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Zou Wei e759ff76eb atm: iphase: fix possible use-after-free in ia_module_exit() 
[ Upstream commit 1c72e6ab66 ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2021-07-19 09:44:38 +02:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-30 11:53:44 +01:00
acpi ACPI: bgrt: Fix CFI violation 2021-07-14 16:56:12 +02:00
amba amba: Fix resource leak for drivers without .remove 2021-03-04 11:38:02 +01:00
android binder: add flag to clear buffer on txn complete 2020-12-30 11:54:09 +01:00
ata pata_ep93xx: fix deferred probing 2021-07-14 16:56:04 +02:00
atm atm: iphase: fix possible use-after-free in ia_module_exit() 2021-07-19 09:44:38 +02:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-03-04 11:38:00 +01:00
base drivers: base: Fix device link removal 2021-06-03 09:00:34 +02:00
bcma bcma: use semicolons rather than commas to separate statements 2020-10-01 16:23:50 +03:00
block loop: Fix missing discard support when using LOOP_CONFIGURE 2021-07-14 16:55:46 +02:00
bluetooth Bluetooth: btqca: Don't modify firmware contents in-place 2021-07-14 16:55:34 +02:00
bus bus: mhi: Wait for M2 state during system resume 2021-07-14 16:55:42 +02:00
cdrom cdrom: gdrom: initialize global variable at init time 2021-05-26 12:06:55 +02:00
char tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status() 2021-07-14 16:56:53 +02:00
clk clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe() 2021-07-19 09:44:37 +02:00
clocksource clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG 2021-07-14 16:56:12 +02:00
connector connector: simplify the return expression of cn_add_callback() 2020-09-21 13:48:29 -07:00
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-03-25 09:04:16 +01:00
cpufreq cpufreq: Make cpufreq_online() call driver->offline() on errors 2021-07-14 16:56:13 +02:00
cpuidle cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration 2021-05-14 09:50:16 +02:00
crypto crypto: qce - fix error return code in qce_skcipher_async_req_handle() 2021-07-14 16:56:54 +02:00
dax device-dax: Fix default return code of range_parse() 2021-03-04 11:38:15 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Add missing error code in devfreq_add_device() 2021-07-14 16:56:11 +02:00
dio maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
dma dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma 2021-06-30 08:47:20 -04:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-01-12 20:18:24 +01:00
edac EDAC/Intel: Do not load EDAC driver when running as a guest 2021-07-14 16:56:00 +02:00
eisa treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
extcon extcon: max8997: Add missing modalias string 2021-07-14 16:56:47 +02:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-04-07 15:00:11 +02:00
firmware firmware: stratix10-svc: Fix a resource leak in an error handling path 2021-07-14 16:56:39 +02:00
fpga fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER 2021-05-14 09:50:06 +02:00
fsi fsi/sbefifo: Fix reset timeout 2021-07-14 16:56:41 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: AMD8111 and TQMX86 require HAS_IOPORT_MAP 2021-07-07 08:22:46 -04:00
gpu drm/amd/display: fix use_max_lb flag for 420 pixel formats 2021-07-19 09:44:37 +02:00
greybus drivers/greybus: Use kobj_to_dev() 2020-09-04 18:06:01 +02:00
hid HID: wacom: Correct base usage for capacitive ExpressKey status bits 2021-07-14 16:56:01 +02:00
hsi HSI: core: fix resource leaks in hsi_add_client_from_dt() 2021-05-14 09:50:28 +02:00
hv drivers: hv: Fix missing error code in vmbus_connect() 2021-07-14 16:55:59 +02:00
hwmon hwmon: (max31790) Fix fan speed reporting for fan7..12 2021-07-14 16:56:08 +02:00
hwspinlock hwspinlock: qcom: Allow mmio usage in addition to syscon 2020-07-13 22:29:28 -07:00
hwtracing coresight: core: Fix use of uninitialized pointer 2021-07-14 16:56:46 +02:00
i2c i2c: robotfuzz-osif: fix control-request directions 2021-06-30 08:47:25 -04:00
i3c Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" 2021-05-14 09:50:05 +02:00
ide ide/falconide: Fix module unload 2021-03-04 11:38:21 +01:00
idle intel_idle: Build fix 2020-12-03 10:00:23 +01:00
iio iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp() 2021-07-14 16:56:46 +02:00
infiniband RDMA/core: Always release restrack object 2021-07-14 16:56:32 +02:00
input Input: hil_kbd - fix error return code in hil_dev_connect() 2021-07-14 16:56:38 +02:00
interconnect interconnect: qcom: Add missing MODULE_DEVICE_TABLE 2021-06-03 09:00:46 +02:00
iommu iommu/dma: Fix compile warning in 32-bit builds 2021-07-14 16:56:55 +02:00
ipack treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
irqchip irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry 2021-06-23 14:42:49 +02:00
isdn isdn: mISDN: netjet: Fix crash in nj_probe: 2021-06-16 12:01:36 +02:00
leds leds: ktd2692: Fix an error handling path 2021-07-14 16:56:48 +02:00
lightnvm lightnvm: fix memory leak when submit fails 2021-01-27 11:55:22 +01:00
macintosh macintosh/adb-iop: Use big-endian autopoll mask 2021-03-04 11:37:42 +01:00
mailbox mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion 2021-07-14 16:56:53 +02:00
mcb drivers: mcb: use symbol namespaces 2019-11-03 19:54:53 +01:00
md dm verity: fix require_signatures module_param permissions 2021-06-16 12:01:37 +02:00
media media: exynos4-is: remove a now unused integer 2021-07-14 16:56:54 +02:00
memory memory: samsung: exynos5422-dmc: handle clk_set_parent() failure 2021-05-14 09:50:19 +02:00
memstick memstick: rtsx_usb_ms: fix UAF 2021-07-14 16:55:53 +02:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-10-26 16:57:18 -04:00
mfd mfd: rn5t618: Fix IRQ trigger by changing it to level mode 2021-07-14 16:56:40 +02:00
misc habanalabs: Fix an error handling path in 'hl_pci_probe()' 2021-07-14 16:56:47 +02:00
mmc mmc: vub3000: fix control-request direction 2021-07-14 16:56:54 +02:00
most drivers: most: add character device interface driver 2020-09-07 15:16:26 +02:00
mtd mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() 2021-07-14 16:56:47 +02:00
mux treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
net net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() 2021-07-19 09:44:37 +02:00
nfc nfc: pn533: prevent potential memory corruption 2021-05-14 09:50:32 +02:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus nubus: Remove cast to void pointer 2019-10-21 09:08:15 +02:00
nvdimm libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC 2021-04-21 13:00:55 +02:00
nvme nvme-pci: look for StorageD3Enable on companion ACPI device instead 2021-07-14 16:56:11 +02:00
nvmem drivers: nvmem: Fix voltage settings for QTI qfprom-efuse 2021-05-14 09:50:14 +02:00
of of: Fix truncation of memory sizes on 32-bit platforms 2021-07-14 16:56:46 +02:00
opp opp: Correct debug message in _opp_add_static_v2() 2021-03-04 11:37:27 +01:00
oprofile module: Fix up module_notifier return values 2020-09-01 09:58:03 +02:00
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pci PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() 2021-07-14 16:56:00 +02:00
pcmcia dma-mapping: remove DMA_MASK_NONE 2020-09-25 06:12:15 +02:00
perf perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number 2021-07-14 16:56:08 +02:00
phy phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() 2021-07-14 16:56:47 +02:00
pinctrl pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities 2021-07-14 16:56:16 +02:00
platform platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() 2021-07-14 16:56:00 +02:00
pnp PNP: fix kernel-doc markups 2020-10-27 19:23:04 +01:00
power power: supply: bq25980: Move props from battery node 2021-05-14 09:50:25 +02:00
powercap Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2020-11-10 10:02:31 -08:00
pps treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-30 11:53:53 +01:00
ptp ptp: improve max_adj check against unreasonable values 2021-06-23 14:42:45 +02:00
pwm pwm: atmel: Fix duty cycle calculation in .get_state() 2021-05-19 10:13:04 +02:00
rapidio rapidio: handle create_workqueue() failure 2021-05-26 12:06:52 +02:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-14 08:42:12 +02:00
regulator regulator: hi655x: Fix pass wrong pointer to config.driver_data 2021-07-14 16:56:09 +02:00
remoteproc remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader 2021-05-19 10:13:01 +02:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() 2021-05-19 10:13:02 +02:00
rtc rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path 2021-07-14 16:55:44 +02:00
s390 s390/cio: dont call css_wait_for_slow_path() inside a lock 2021-07-14 16:55:43 +02:00
sbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
scsi scsi: core: Retry I/O for Notify (Enable Spinup) Required error 2021-07-14 16:56:54 +02:00
sfi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sh iomap: constify ioreadX() iomem argument (as in generic implementation) 2020-08-14 19:56:57 -07:00
siox siox: Use the correct style for SPDX License Identifier 2020-01-14 21:46:53 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-30 11:53:47 +01:00
soc soc: aspeed: fix a ternary sign expansion bug 2021-05-14 09:50:21 +02:00
soundwire soundwire: stream: Fix test for DP prepare complete 2021-07-14 16:56:47 +02:00
spi spi: spi-sun6i: Fix chipselect/clock bug 2021-07-14 16:56:10 +02:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-03-04 11:38:40 +01:00
ssb ssb: Fix error return code in ssb_bus_scan() 2021-07-14 16:56:21 +02:00
staging staging: mt7621-dts: fix pci address for PCI memory range 2021-07-14 16:56:46 +02:00
target scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() 2021-07-14 16:56:53 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee optee: use export_uuid() to copy client UUID 2021-06-10 13:39:21 +02:00
thermal thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure 2021-07-14 16:55:47 +02:00
thunderbolt thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default() 2021-07-14 16:56:44 +02:00
tty serial: mvebu-uart: correctly calculate minimal possible baudrate 2021-07-14 16:56:50 +02:00
uio uio_hv_generic: Fix a memory leak in error handling paths 2021-05-26 12:06:52 +02:00
usb usb: dwc2: Don't reset the core after setting turnaround time 2021-07-14 16:56:43 +02:00
vdpa {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table 2021-06-03 09:00:36 +02:00
vfio vfio/pci: Handle concurrent vma faults 2021-07-14 16:56:50 +02:00
vhost vhost-vdpa: fix vm_flags for virtqueue doorbell mapping 2021-05-11 14:47:12 +02:00
video backlight: lm3630a_bl: Put fwnode in error case during ->probe() 2021-07-14 16:56:38 +02:00
virt nitro_enclaves: Fix stale file descriptors on failed usercopy 2021-05-11 14:47:11 +02:00
virtio virtio_ring: Fix two use after free bugs 2020-12-30 11:54:00 +01:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-07-14 16:56:41 +02:00
vlynq treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 102 2019-05-24 17:39:00 +02:00
vme treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
w1 w1: w1_therm: Fix conversion result for negative temperatures 2021-03-04 11:37:18 +01:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-03-04 11:38:36 +01:00
xen xen/events: reset active flag for lateeoi events later 2021-07-11 12:53:31 +02:00
zorro zorro: Fix address space collision message with RAM expansion boards 2020-08-26 13:26:52 +02:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile vdpa: mlx5: fix vdpa/vhost dependencies 2020-12-02 04:09:56 -05:00