kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/mmc/host
History
Guangshuo Li 7c0c50fffd mmc: vub300: fix use-after-free on probe failure 
The vub300 driver lifetime-manages its controller state using
vub300->kref, with vub300_delete() freeing the mmc host when the last
reference is dropped. The probe error path after the inactivity timer has
been armed still bypasses that lifetime rule, however, and falls through
to mmc_free_host() directly if mmc_add_host() fails.

The race window is between arming the inactivity timer and reaching the
probe error unwind after mmc_add_host() fails:

        probe thread                     timer/workqueue
        ------------                     ---------------
        kref_init(&vub300->kref)         ref = 1
        kref_get(&vub300->kref)          ref = 2, timer ref
        add_timer(inactivity_timer)      fires after one second
        |
        |   race window
        |<---------------------------------------------------->
        |
        mmc_add_host(mmc)
                                         inactivity timer fires
                                         vub300_queue_dead_work()
                                           kref_get()          ref = 3
                                           queue_work(deadwork)
        mmc_add_host() fails
        timer_delete_sync()
        mmc_free_host(mmc)
          frees vub300
                                         deadwork runs
                                           use-after-free

The inactivity timeout is one second, so this would require
mmc_add_host() to both fail and take more than one second to do so. This
is unlikely to happen in practice, but the error path is still wrong.

timer_delete_sync() only waits for the timer callback itself. It does
not flush deadwork that the callback may already have queued. As a
result, queued deadwork can still hold a kref while the probe error path
directly frees the backing mmc host, including the vub300 storage.

Fix this by using the same lifetime mechanism as disconnect. Clear
vub300->interface so that the timer callback and any queued deadwork
return early and drop their references, then drop the initial probe
reference and return without falling through to err_free_host.

Fixes: 0613ad2401 ("mmc: vub300: fix return value check of mmc_add_host()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
(cherry picked from commit a3b5f24299)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-23 14:17:23 +02:00
..
alcor.c mmc: alcor: fix return value check of mmc_add_host() 2022-12-31 13:14:16 +01:00
atmel-mci.c mmc: atmel-mci: Add missing clk_disable_unprepare() 2025-04-10 14:31:54 +02:00
au1xmmc.c mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() 2022-10-26 12:34:55 +02:00
bcm2835.c mmc: bcm2835: Fix dma_unmap_sg() nents value 2025-08-28 16:23:59 +02:00
cavium-octeon.c mmc: cavium-octeon: Add of_node_put() when breaking out of loop 2022-08-17 14:23:56 +02:00
cavium-thunderx.c mmc: cavium-thunderx: Add of_node_put() when breaking out of loop 2022-08-17 14:23:57 +02:00
cavium.c mmc: cavium: Use '"%s...", __func__' to print function name 2021-03-30 11:42:06 +02:00
cavium.h mmc: cavium: Add scatter-gather DMA support 2017-04-24 21:42:10 +02:00
cb710-mmc.c mmc: cb710: Use new tasklet API 2021-02-15 10:43:23 +01:00
cb710-mmc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cqhci-core.c mmc: cqhci: Fix checking of CQHCI_HALT state 2024-09-12 11:07:43 +02:00
cqhci-crypto.c mmc: cqhci: add cqhci_host_ops::program_key 2021-02-01 12:02:33 +01:00
cqhci-crypto.h mmc: core: Store pointer to bio_crypt_ctx in mmc_request 2021-08-24 10:15:32 +02:00
cqhci.h mmc: cqhci: add cqhci_host_ops::program_key 2021-02-01 12:02:33 +01:00
davinci_mmc.c mmc: davinci: Don't strip remove function when driver is builtin 2024-07-05 09:14:12 +02:00
dw_mmc-bluefield.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.19 2020-09-07 14:24:21 +02:00
dw_mmc-exynos.c mmc: dw_mmc: exynos: fix the finding clock sample value 2021-10-26 17:28:41 +02:00
dw_mmc-exynos.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dw_mmc-hi3798cv200.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.19 2020-09-07 14:24:21 +02:00
dw_mmc-k3.c mmc: dw_mmc-k3: use the correct HiSilicon copyright 2021-03-31 14:47:53 +02:00
dw_mmc-pci.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dw_mmc-pltfm.c mmc: dw_mmc-pltfm: Remove unused <linux/clk.h> 2021-06-14 13:57:42 +02:00
dw_mmc-pltfm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dw_mmc-rockchip.c mmc: dw_mmc-rockchip: Just set default sample value for legacy mode 2021-04-16 15:10:08 +02:00
dw_mmc.c Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" 2024-12-14 19:50:36 +01:00
dw_mmc.h mmc: dw_mmc: Add data CRC error injection 2021-08-24 10:15:31 +02:00
jz4740_mmc.c PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro 2024-03-01 13:21:54 +01:00
Kconfig mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig 2026-01-19 13:09:46 +01:00
Makefile mmc: mmc_spi: Make of_mmc_spi.c resource provider agnostic 2021-04-23 09:29:49 +02:00
meson-gx-mmc.c mmc: meson-gx: Remove setting of CMD_CFG_ERROR 2023-11-28 16:56:30 +00:00
meson-mx-sdhc-clkc.c mmc: meson-mx-sdhc: Don't use literal 0 to initialize structs 2020-05-28 11:22:15 +02:00
meson-mx-sdhc-mmc.c mmc: meson-mx-sdhc: Fix initialization frozen issue 2024-01-15 18:51:23 +01:00
meson-mx-sdhc.h mmc: host: meson-mx-sdhc: new driver for the Amlogic Meson SDHC host 2020-05-28 11:22:14 +02:00
meson-mx-sdio.c mmc: meson-mx-sdio: add IRQ check 2022-01-27 11:03:43 +01:00
mmc_hsq.c mmc: hsq: Fix data stomping during mmc recovery 2022-10-05 10:39:38 +02:00
mmc_hsq.h mmc: host: Introduce the request_atomic() for the host 2020-05-28 11:20:59 +02:00
mmc_spi.c mmc: mmc_spi: drop buggy snprintf() 2024-12-14 19:50:47 +01:00
mmci.c mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS 2023-07-23 13:47:32 +02:00
mmci.h mmc: mmci_sdmmc: Implement signal voltage callbacks 2020-03-24 14:35:40 +01:00
mmci_qcom_dml.c mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() 2026-04-18 10:33:14 +02:00
mmci_stm32_sdmmc.c mmc: mmci: stm32: fix DMA API overlapping mappings warning 2024-03-15 10:48:13 -04:00
moxart-mmc.c mmc: moxart: read scr register without changing byte order 2023-08-16 18:21:57 +02:00
mtk-sd.c mtk-sd: reset host->mrq on prepare_data() error 2025-07-10 15:57:43 +02:00
mvsdio.c mmc: mvsdio: Fix dma_unmap_sg() nents value 2025-10-02 13:39:07 +02:00
mvsdio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mxcmmc.c PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro 2024-03-01 13:21:54 +01:00
mxs-mmc.c mmc: mxs-mmc: disable regulator on error and in the remove function 2021-11-18 19:16:34 +01:00
of_mmc_spi.c mmc: mmc_spi: Imply container_of() to be no-op 2021-06-14 13:57:42 +02:00
omap.c mmc: omap: fix deferred probing 2023-06-28 10:29:47 +02:00
omap_hsmmc.c mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit 2026-08-23 14:17:16 +02:00
owl-mmc.c mmc: owl: fix deferred probing 2023-06-28 10:29:47 +02:00
pxamci.c mmc: pxamci: fix return value check of mmc_add_host() 2022-12-31 13:14:16 +01:00
pxamci.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
renesas_sdhi.h mmc: renesas_sdhi: Refactor renesas_sdhi_probe() 2021-08-24 10:15:35 +02:00
renesas_sdhi_core.c mmc: host: renesas_sdhi: Fix the actual clock 2025-12-07 06:09:16 +09:00
renesas_sdhi_internal_dmac.c mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC 2026-06-19 13:33:38 +02:00
renesas_sdhi_sys_dmac.c mmc: renesas_sdhi: Refactor renesas_sdhi_probe() 2021-08-24 10:15:35 +02:00
rtsx_pci_sdmmc.c Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" 2026-03-04 07:19:46 -05:00
rtsx_usb_sdmmc.c mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() 2025-08-28 16:24:18 +02:00
s3cmci.c mmc: s3cmci: move to use request_irq by IRQF_NO_AUTOEN flag 2021-06-14 13:57:34 +02:00
s3cmci.h MMC core: 2019-07-11 18:11:21 -07:00
sdhci-acpi.c mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A 2024-06-16 13:39:57 +02:00
sdhci-bcm-kona.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4 2020-09-07 14:20:17 +02:00
sdhci-brcmstb.c mmc: sdhci-brcmstb: Initialize base_clk to NULL in sdhci_brcmstb_probe() 2025-04-10 14:32:07 +02:00
sdhci-cadence.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14 2020-09-07 14:24:21 +02:00
sdhci-cns3xxx.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4 2020-09-07 14:20:17 +02:00
sdhci-cqhci.h mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI 2022-11-16 09:58:24 +01:00
sdhci-dove.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4 2020-09-07 14:20:17 +02:00
sdhci-esdhc-imx.c mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450 2023-09-23 11:09:56 +02:00
sdhci-esdhc-mcf.c mmc: sdhci: replace mmc->parent with mmc_dev() for consistency 2021-03-30 11:42:07 +02:00
sdhci-esdhc.h mmc: sdhci-of-esdhc: make sure delay chain locked for HS400 2020-10-28 11:07:01 +01:00
sdhci-iproc.c Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711" 2021-08-27 16:30:36 +02:00
sdhci-milbeaut.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that are newer than 5.4 2020-09-07 14:24:21 +02:00
sdhci-msm.c mmc: sdhci-msm: Avoid early clock doubling during HS400 transition 2026-01-19 13:09:48 +01:00
sdhci-of-arasan.c mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI 2022-11-16 09:58:24 +01:00
sdhci-of-aspeed-test.c mmc: sdhci-of-aspeed: Remove some unnecessary casts from KUnit tests 2021-06-23 16:39:08 -06:00
sdhci-of-aspeed.c mmc: sdhci-of-aspeed: fix module autoloading 2024-09-12 11:07:43 +02:00
sdhci-of-at91.c mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R 2022-08-17 14:23:50 +02:00
sdhci-of-dwcmshc.c mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration 2026-06-19 13:33:42 +02:00
sdhci-of-esdhc.c mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data 2023-05-11 23:00:23 +09:00
sdhci-of-hlwd.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4 2020-09-07 14:20:17 +02:00
sdhci-of-sparx5.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that are newer than 5.4 2020-09-07 14:24:21 +02:00
sdhci-omap.c mmc: sdhci-omap: Fix context restore 2021-11-18 19:16:31 +01:00
sdhci-pci-arasan.c mmc:host:sdhci-pci:Addition of Arasan PCI Controller with integrated phy. 2018-01-04 12:46:11 +01:00
sdhci-pci-core.c mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models 2025-08-28 16:24:00 +02:00
sdhci-pci-data.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
sdhci-pci-dwc-mshc.c mmc: sdhci-pci-dwc-mshc: synopsys dwc mshc support 2018-07-16 11:21:45 +02:00
sdhci-pci-gli.c mmc: sdhci-pci-gli: fix GL9750 DMA write corruption 2026-04-18 10:33:17 +02:00
sdhci-pci-o2micro.c mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout 2022-11-26 09:24:48 +01:00
sdhci-pci.h mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet 2024-12-14 19:51:34 +01:00
sdhci-pic32.c mmc: sdhci-pic32: Make pic32_sdhci_probe_platform() void 2020-11-16 11:59:30 +01:00
sdhci-pltfm.c mmc: Remove dev_err() usage after platform_get_irq() 2019-09-11 15:58:39 +02:00
sdhci-pltfm.h mmc: sdhci-pltfm: Fix linking err for sdhci-brcmstb 2021-02-01 11:13:09 +01:00
sdhci-pxav2.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4 2020-09-07 14:20:17 +02:00
sdhci-pxav3.c mmc: sdhci-pxav3: set NEED_RSP_BUSY capability 2025-04-10 14:32:06 +02:00
sdhci-s3c.c mmc: sdhci-s3c: constify uses of driver/match data 2021-04-15 14:00:15 +02:00
sdhci-spear.c mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4 2020-09-07 14:20:17 +02:00
sdhci-sprd.c mmc: sdhci-sprd: Fix eMMC init failure after hw reset 2024-01-15 18:51:24 +01:00
sdhci-st.c mmc: sdhci-st: Remove unnecessary error log 2021-04-12 13:52:48 +02:00
sdhci-tegra.c mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk 2025-01-09 13:28:32 +01:00
sdhci-xenon-phy.c mmc: sdhci-xenon: fix PHY init clock stability 2024-03-06 14:38:49 +00:00
sdhci-xenon.c Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" 2022-04-13 20:59:21 +02:00
sdhci-xenon.h mmc: sdhci-xenon: switch to device_* API 2020-12-11 10:08:37 +01:00
sdhci.c mmc: sdhci: unmap the bounce buffer before device release 2026-08-23 14:17:16 +02:00
sdhci.h mmc: sdhci: make tuning_err a signed int 2026-08-23 14:17:16 +02:00
sdhci_am654.c mmc: sdhci_am654: Workaround for Errata i2312 2025-08-28 16:24:00 +02:00
sdhci_f_sdh30.c mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove 2023-08-26 14:23:38 +02:00
sdhci_f_sdh30.h mmc: sdhci-milbeaut: add Milbeaut SD controller driver 2019-11-13 16:10:16 +01:00
sdricoh_cs.c mmc: sdricoh_cs: Respect the cmd->busy_timeout from the mmc core 2020-05-28 11:22:14 +02:00
sh_mmcif.c mmc: sh_mmcif: fix deferred probing 2023-06-28 10:29:47 +02:00
sunxi-mmc.c mmc: sunxi-mmc: Fix A100 compatible description 2024-12-14 19:50:37 +01:00
tifm_sd.c mmc: switch from 'pci_' to 'dma_' API 2021-08-24 16:59:39 +02:00
tmio_mmc.c mmc: tmio: avoid glitches when resetting 2022-08-25 11:40:36 +02:00
tmio_mmc.h mmc: tmio: avoid glitches when resetting 2022-08-25 11:40:36 +02:00
tmio_mmc_core.c mmc: tmio: avoid concurrent runs of mmc_request_done() 2024-04-10 16:18:38 +02:00
toshsd.c mmc: toshsd: fix return value check of mmc_add_host() 2022-12-31 13:14:17 +01:00
toshsd.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
uniphier-sd.c mmc: uniphier-sd: Fix a resource leak in the remove function 2021-03-30 11:41:59 +02:00
usdhi6rol0.c mmc: usdhi60rol0: fix deferred probing 2023-06-28 10:29:47 +02:00
ushc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
via-sdmmc.c mmc: via-sdmmc: fix return value check of mmc_add_host() 2022-12-31 13:14:17 +01:00
vub300.c mmc: vub300: fix use-after-free on probe failure 2026-08-23 14:17:23 +02:00
wbsd.c mmc: wbsd: fix double mmc_free_host() in wbsd_init() 2023-08-26 14:23:37 +02:00
wbsd.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
wmt-sdmmc.c mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function 2024-03-26 18:21:21 -04:00