kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Roger Pau Monne 6b53db8c4c xen-netback: take a reference to the RX task thread 
commit 107866a8eb upstream.

Do this in order to prevent the task from being freed if the thread
returns (which can be triggered by the frontend) before the call to
kthread_stop done as part of the backend tear down. Not taking the
reference will lead to a use-after-free in that scenario. Such
reference was taken before but dropped as part of the rework done in
2ac061ce97.

Reintroduce the reference taking and add a comment this time
explaining why it's needed.

This is XSA-374 / CVE-2021-28691.

Fixes: 2ac061ce97 ('xen/netback: cleanup init and deinit code')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Cc: stable@vger.kernel.org
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2021-06-10 13:39:29 +02:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-30 11:53:44 +01:00
acpi ACPICA: Clean up context mutex during object deletion 2021-06-10 13:39:17 +02:00
amba amba: Fix resource leak for drivers without .remove 2021-03-04 11:38:02 +01:00
android binder: add flag to clear buffer on txn complete 2020-12-30 11:54:09 +01:00
ata ata: libahci_platform: fix IRQ check 2021-05-14 09:50:24 +02:00
atm atm: idt77252: fix null-ptr-dereference 2021-03-30 14:31:50 +02:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-03-04 11:38:00 +01:00
base drivers: base: Fix device link removal 2021-06-03 09:00:34 +02:00
bcma bcma: use semicolons rather than commas to separate statements 2020-10-01 16:23:50 +03:00
block nbd: Fix NULL pointer in flush_workqueue 2021-05-19 10:13:14 +02:00
bluetooth Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip. 2021-05-19 10:12:54 +02:00
bus bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act 2021-06-10 13:39:22 +02:00
cdrom cdrom: gdrom: initialize global variable at init time 2021-05-26 12:06:55 +02:00
char char: hpet: add checks after calling ioremap 2021-06-03 09:00:41 +02:00
clk clk: exynos7: Mark aclk_fsys1_200 as critical 2021-05-19 10:13:19 +02:00
clocksource clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940 2021-05-19 10:13:18 +02:00
connector connector: simplify the return expression of cn_add_callback() 2020-09-21 13:48:29 -07:00
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-03-25 09:04:16 +01:00
cpufreq cpufreq: intel_pstate: Use HWP if enabled by platform firmware 2021-05-19 10:12:51 +02:00
cpuidle cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration 2021-05-14 09:50:16 +02:00
crypto Revert "crypto: cavium/nitrox - add an error message to explain the failure of pci_request_mem_regions" 2021-06-03 09:00:40 +02:00
dax device-dax: Fix default return code of range_parse() 2021-03-04 11:38:15 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Use more accurate returned new_freq as resume_freq 2021-05-14 09:50:15 +02:00
dio maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
dma dmaengine: qcom_hidma: comment platform_driver_register call 2021-06-03 09:00:42 +02:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-01-12 20:18:24 +01:00
edac EDAC/amd64: Do not load on family 0x15, model 0x13 2021-03-07 12:34:08 +01:00
eisa treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
extcon extcon: arizona: Fix various races on driver unbind 2021-05-11 14:47:24 +02:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-04-07 15:00:11 +02:00
firmware efi: cper: fix snprintf() use in cper_dimm_err_location() 2021-06-10 13:39:14 +02:00
fpga fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER 2021-05-14 09:50:06 +02:00
fsi fsi: Aspeed: Add mutex to protect HW access 2020-12-30 11:53:46 +01:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: cadence: Add missing MODULE_DEVICE_TABLE 2021-06-03 09:00:39 +02:00
gpu drm/msm/dpu: always use mdp device to scale bandwidth 2021-06-10 13:39:28 +02:00
greybus drivers/greybus: Use kobj_to_dev() 2020-09-04 18:06:01 +02:00
hid HID: multitouch: require Finger field to mark Win8 reports as MT 2021-06-10 13:39:25 +02:00
hsi HSI: core: fix resource leaks in hsi_add_client_from_dt() 2021-05-14 09:50:28 +02:00
hv Drivers: hv: vmbus: Increase wait time for VMbus unload 2021-05-14 09:50:21 +02:00
hwmon hwmon: (pmbus/isl68137) remove READ_TEMPERATURE_3 for RAA228228 2021-06-10 13:39:13 +02:00
hwspinlock hwspinlock: qcom: Allow mmio usage in addition to syscon 2020-07-13 22:29:28 -07:00
hwtracing coresight: Do not scan for graph if none is present 2021-05-19 10:12:55 +02:00
i2c i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops 2021-06-10 13:39:29 +02:00
i3c Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" 2021-05-14 09:50:05 +02:00
ide ide/falconide: Fix module unload 2021-03-04 11:38:21 +01:00
idle intel_idle: Build fix 2020-12-03 10:00:23 +01:00
iio iio: adc: ad7192: handle regulator voltage error first 2021-06-03 09:00:33 +02:00
infiniband RDMA/uverbs: Fix a NULL vs IS_ERR() bug 2021-05-26 12:06:49 +02:00
input Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state 2021-05-22 11:40:52 +02:00
interconnect interconnect: qcom: Add missing MODULE_DEVICE_TABLE 2021-06-03 09:00:46 +02:00
iommu iommu/vt-d: Use user privilege for RID2PASID translation 2021-06-03 09:00:49 +02:00
ipack treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
irqchip irqchip/gic-v3: Fix OF_BAD_ADDR error handling 2021-05-14 09:50:15 +02:00
isdn isdn: mISDN: correctly handle ph_info allocation failure in hfcsusb_ph_info 2021-06-03 09:00:42 +02:00
leds leds: lp5523: check return value of lp5xx_read and jump to cleanup code 2021-05-26 12:06:56 +02:00
lightnvm lightnvm: fix memory leak when submit fails 2021-01-27 11:55:22 +01:00
macintosh macintosh/adb-iop: Use big-endian autopoll mask 2021-03-04 11:37:42 +01:00
mailbox mailbox: sprd: Introduce refcnt when clients requests/free channels 2021-05-14 09:50:27 +02:00
mcb drivers: mcb: use symbol namespaces 2019-11-03 19:54:53 +01:00
md dm snapshot: properly fix a crash when an origin has no snapshots 2021-06-03 09:00:30 +02:00
media media: gspca: properly check for errors in po1030_probe() 2021-06-03 09:00:43 +02:00
memory memory: samsung: exynos5422-dmc: handle clk_set_parent() failure 2021-05-14 09:50:19 +02:00
memstick memstick: r592: Fix error return in r592_probe() 2020-12-30 11:53:34 +01:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-10-26 16:57:18 -04:00
mfd mfd: stm32-timers: Avoid clearing auto reload register 2021-05-14 09:50:27 +02:00
misc platform/x86: hp_accel: Avoid invoking _INI to speed up resume 2021-06-03 09:00:39 +02:00
mmc mmc: sdhci-pci-gli: increase 1.8V regulator wait 2021-05-26 12:06:53 +02:00
most drivers: most: add character device interface driver 2020-09-07 15:16:26 +02:00
mtd mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init 2021-05-14 09:50:15 +02:00
mux treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
net xen-netback: take a reference to the RX task thread 2021-06-10 13:39:29 +02:00
nfc nfc: pn533: prevent potential memory corruption 2021-05-14 09:50:32 +02:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus nubus: Remove cast to void pointer 2019-10-21 09:08:15 +02:00
nvdimm libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC 2021-04-21 13:00:55 +02:00
nvme nvmet: fix freeing unallocated p2pmem 2021-06-10 13:39:18 +02:00
nvmem drivers: nvmem: Fix voltage settings for QTI qfprom-efuse 2021-05-14 09:50:14 +02:00
of of: overlay: fix for_each_child.cocci warnings 2021-05-14 09:50:24 +02:00
opp opp: Correct debug message in _opp_add_static_v2() 2021-03-04 11:37:27 +01:00
oprofile module: Fix up module_notifier return values 2020-09-01 09:58:03 +02:00
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pci PCI: tegra: Fix runtime PM imbalance in pex_ep_event_pex_rst_deassert() 2021-05-22 11:40:52 +02:00
pcmcia dma-mapping: remove DMA_MASK_NONE 2020-09-25 06:12:15 +02:00
perf perf/arm_pmu_platform: Fix error handling 2021-05-11 14:47:19 +02:00
phy phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally 2021-05-14 09:50:13 +02:00
pinctrl pinctrl: samsung: use 'int' for register masks in Exynos 2021-05-19 10:12:55 +02:00
platform platform/x86: touchscreen_dmi: Add info for the Chuwi Hi10 Pro (CWI529) tablet 2021-06-03 09:00:45 +02:00
pnp PNP: fix kernel-doc markups 2020-10-27 19:23:04 +01:00
power power: supply: bq25980: Move props from battery node 2021-05-14 09:50:25 +02:00
powercap Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2020-11-10 10:02:31 -08:00
pps treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-30 11:53:53 +01:00
ptp ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation 2021-04-10 13:36:09 +02:00
pwm pwm: atmel: Fix duty cycle calculation in .get_state() 2021-05-19 10:13:04 +02:00
rapidio rapidio: handle create_workqueue() failure 2021-05-26 12:06:52 +02:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-14 08:42:12 +02:00
regulator regulator: bd9576: Fix return from bd957x_probe() 2021-05-14 09:50:10 +02:00
remoteproc remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader 2021-05-19 10:13:01 +02:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() 2021-05-19 10:13:02 +02:00
rtc rtc: pcf85063: fallback to parent of_node 2021-05-26 12:06:57 +02:00
s390 vfio-ccw: Check initialized flag in cp_init() 2021-06-03 09:00:46 +02:00
sbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
scsi scsi: libsas: Use _safe() loop in sas_resume_port() 2021-06-03 09:00:50 +02:00
sfi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sh iomap: constify ioreadX() iomem argument (as in generic implementation) 2020-08-14 19:56:57 -07:00
siox siox: Use the correct style for SPDX License Identifier 2020-01-14 21:46:53 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-30 11:53:47 +01:00
soc soc: aspeed: fix a ternary sign expansion bug 2021-05-14 09:50:21 +02:00
soundwire soundwire: stream: fix memory leak in stream config error path 2021-05-14 09:50:14 +02:00
spi spi: Assume GPIO CS active high in ACPI case 2021-06-03 09:00:46 +02:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-03-04 11:38:40 +01:00
ssb ssb: Remove meaningless jump label to simplify the code 2020-09-21 16:01:35 +03:00
staging staging: emxx_udc: fix loop in _nbu2ss_nuke() 2021-06-03 09:00:49 +02:00
target scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found 2021-05-22 11:40:54 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee optee: use export_uuid() to copy client UUID 2021-06-10 13:39:21 +02:00
thermal thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID 2021-06-03 09:00:35 +02:00
thunderbolt thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue 2021-06-03 09:00:32 +02:00
tty serial: stm32: fix threaded interrupt handling 2021-06-10 13:39:22 +02:00
uio uio_hv_generic: Fix a memory leak in error handling paths 2021-05-26 12:06:52 +02:00
usb usb: dwc2: Fix build in periphal-only mode 2021-06-10 13:39:26 +02:00
vdpa {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table 2021-06-03 09:00:36 +02:00
vfio vfio/platform: fix module_put call in error flow 2021-06-10 13:39:15 +02:00
vhost vhost-vdpa: fix vm_flags for virtqueue doorbell mapping 2021-05-11 14:47:12 +02:00
video video: hgafb: correctly handle card detect failure during probe 2021-05-26 12:06:57 +02:00
virt nitro_enclaves: Fix stale file descriptors on failed usercopy 2021-05-11 14:47:11 +02:00
virtio virtio_ring: Fix two use after free bugs 2020-12-30 11:54:00 +01:00
visorbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vlynq treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 102 2019-05-24 17:39:00 +02:00
vme treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
w1 w1: w1_therm: Fix conversion result for negative temperatures 2021-03-04 11:37:18 +01:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-03-04 11:38:36 +01:00
xen xen-pciback: reconfigure also from backend watch handler 2021-05-26 12:06:54 +02:00
zorro zorro: Fix address space collision message with RAM expansion boards 2020-08-26 13:26:52 +02:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile vdpa: mlx5: fix vdpa/vhost dependencies 2020-12-02 04:09:56 -05:00