kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Kaixin Wang 56bddf543d i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition 
commit 6185072577 upstream.

In the svc_i3c_master_probe function, &master->hj_work is bound with
svc_i3c_master_hj_work, &master->ibi_work is bound with
svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work  can start the
hj_work, svc_i3c_master_irq_handler can start the ibi_work.

If we remove the module which will call svc_i3c_master_remove to
make cleanup, it will free master->base through i3c_master_unregister
while the work mentioned above will be used. The sequence of operations
that may lead to a UAF bug is as follows:

CPU0                                         CPU1

                                    | svc_i3c_master_hj_work
svc_i3c_master_remove               |
i3c_master_unregister(&master->base)|
device_unregister(&master->dev)     |
device_release                      |
//free master->base                 |
                                    | i3c_master_do_daa(&master->base)
                                    | //use master->base

Fix it by ensuring that the work is canceled before proceeding with the
cleanup in svc_i3c_master_remove.

Fixes: 0f74f8b667 ("i3c: Make i3c_master_unregister() return void")
Cc: stable@vger.kernel.org
Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/stable/20240914154030.180-1-kxwang23%40m.fudan.edu.cn
Link: https://lore.kernel.org/r/20240914163932.253-1-kxwang23@m.fudan.edu.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-12-14 19:54:56 +01:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:02:55 +02:00
acpi ACPI: CPPC: Fix _CPC register setting issue 2024-12-14 19:53:18 +01:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:10:26 +02:00
ata ata: libata: avoid superfluous disk spin down + spin up during hibernation 2024-10-17 15:22:26 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:30:24 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:49:51 +02:00
base regmap: detach regmap from dev on regmap_exit 2024-12-14 19:54:36 +01:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block ublk: fix error code for unsupported command 2024-12-14 19:54:06 +01:00
bluetooth Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables 2024-12-14 19:54:44 +01:00
bus bus: mhi: host: pci_generic: Fix the name for the Telit FE990A 2024-10-17 15:21:20 +02:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:47:10 +02:00
char char: xillybus: Fix trivial bug with mutex 2024-11-22 15:37:35 +01:00
clk clk: qcom: gcc-qcs404: fix initial rate of GPLL3 2024-12-14 19:54:13 +01:00
clocksource clocksource/drivers/timer-ti-dm: Fix child node refcount handling 2024-12-14 19:53:19 +01:00
comedi comedi: Flush partial mappings in error case 2024-12-14 19:53:59 +01:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: ti-ecap-capture: Add check for clk_enable() 2024-12-14 19:53:53 +01:00
cpufreq cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() 2024-12-14 19:54:02 +01:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:04:54 +02:00
crypto crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() 2024-12-14 19:53:18 +01:00
cxl cxl/pci: fix error code in __cxl_hdm_decode_init() 2024-11-22 15:37:32 +01:00
dax dax: delete a stale directory pmem 2024-12-14 19:53:41 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:12:47 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor 2024-09-08 07:53:11 +02:00
dma-buf dma-fence: Use kernel's sort for merging fences 2024-12-14 19:54:36 +01:00
edac EDAC/igen6: Avoid segmentation fault on module unload 2024-12-14 19:53:17 +01:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:03:41 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:56:16 +02:00
firmware arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-12-14 19:54:53 +01:00
fpga fpga: manager: add owner module and take its refcount 2024-12-14 19:53:12 +01:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: grgpio: Add NULL check in grgpio_probe 2024-12-14 19:54:24 +01:00
gpu drm/msm: DEVFREQ_GOV_SIMPLE_ONDEMAND is no longer needed 2024-12-14 19:54:55 +01:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:36:00 +02:00
hid HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support 2024-12-14 19:54:38 +01:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2022-12-31 13:32:45 +01:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:10:26 +02:00
hwmon hwmon: (tps23861) Fix reporting of negative temperatures 2024-12-14 19:53:48 +01:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:53:09 +02:00
hwtracing coresight: tmc: sg: Do not leak sg_table 2024-10-17 15:21:11 +02:00
i2c i2c: i801: Use a different adapter-name for IDF adapters 2024-10-17 15:22:14 +02:00
i3c i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition 2024-12-14 19:54:56 +01:00
idle intel_idle: add Emerald Rapids Xeon support 2023-10-10 22:00:44 +02:00
iio iio: light: ltr501: Add LTER0303 to the supported devices 2024-12-14 19:54:48 +01:00
infiniband RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() 2024-12-14 19:53:41 +01:00
input Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal 2024-10-17 15:22:12 +02:00
interconnect interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID 2024-08-03 08:49:19 +02:00
iommu iommu/arm-smmu: Defer probe of clients after smmu device bound 2024-12-14 19:54:37 +01:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip/ocelot: Fix trigger register address 2024-11-17 15:07:20 +01:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-03 08:49:50 +02:00
leds leds: class: Protect brightness_show() with led_cdev->led_access mutex 2024-12-14 19:54:46 +01:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:49:22 +02:00
mailbox mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() 2024-12-14 19:53:54 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:07:13 +00:00
md bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again 2024-12-14 19:54:34 +01:00
media media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 2024-12-14 19:54:38 +01:00
memory memory: renesas-rpc-if: Pass device instead of rpcif to rpcif_*() 2024-12-14 19:53:36 +01:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-07-19 16:21:08 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:53:40 +01:00
mfd mfd: rt5033: Fix missing regmap_del_irq_chip() 2024-12-14 19:53:40 +01:00
misc misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle 2024-12-14 19:54:49 +01:00
mmc mmc: mtk-sd: Fix error handle of probe function 2024-12-14 19:54:52 +01:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd ubi: fastmap: Fix duplicate slab cache names while attaching 2024-12-14 19:54:08 +01:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net veth: Use tstats per-CPU traffic counters 2024-12-14 19:54:54 +01:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:25:02 +02:00
ntb ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition 2024-10-17 15:22:15 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 19:54:47 +01:00
nvme nvme-pci: reverse request order in nvme_queue_rqs 2024-12-14 19:53:16 +01:00
nvmem nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc 2024-09-12 11:10:26 +02:00
of of/irq: Support #msi-cells=<0> in of_msi_get_domain 2024-10-17 15:21:55 +02:00
opp OPP: ti: Fix ti_opp_supply_probe wrong return values 2024-08-03 08:48:58 +02:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport parport: Proper fix for array out-of-bounds access 2024-10-22 15:56:49 +02:00
pci PCI: Add ACS quirk for Wangxun FF5xxx NICs 2024-12-14 19:54:48 +01:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:10:20 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf perf/arm-cmn: Ensure port and device id bits are set properly 2024-12-14 19:54:09 +01:00
phy phy: zynqmp: Take the phy mutex in xlate 2024-09-12 11:10:22 +02:00
pinctrl pinctrl: qcom: spmi-mpp: Add PM8937 compatible 2024-12-14 19:54:47 +01:00
platform platform/chrome: cros_ec_typec: fix missing fwnode reference decrement 2024-12-14 19:54:02 +01:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: bq27xxx: Fix registers of bq27426 2024-12-14 19:53:49 +01:00
powercap powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() 2024-11-01 01:56:05 +01:00
pps tty/serial: Make ->dcd_change()+uart_handle_dcd_change() status bool active 2024-11-01 01:56:02 +01:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Add error handling for adjfine callback in ptp_clock_adjtime 2024-12-14 19:54:21 +01:00
pwm pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle 2024-12-14 19:53:22 +01:00
rapidio rapidio: devices: fix missing put_device in mport_cdev_open 2022-12-31 13:32:00 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: rk808: Add apply_bit for BUCK3 on RK809 2024-12-14 19:53:09 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region 2024-12-14 19:53:47 +01:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-17 15:20:47 +02:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-14 19:53:47 +01:00
rtc rtc: cmos: avoid taking rtc_lock for extended period of time 2024-12-14 19:54:49 +01:00
s390 s390/cio: Do not unregister the subchannel based on DNV 2024-12-14 19:53:14 +01:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset 2024-12-14 19:54:46 +01:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-14 19:54:09 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 11:56:20 +02:00
soc soc: imx8m: Probe the SoC driver as platform driver 2024-12-14 19:54:38 +01:00
soundwire soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-09-18 19:23:06 +02:00
spi spi: mpc52xx: Add cancel_work_sync before module remove 2024-12-14 19:54:30 +01:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:35:55 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:30:27 +02:00
staging media: atomisp: Add check for rgby_data memory allocation failure 2024-12-14 19:53:24 +01:00
target scsi: target: core: Fix null-ptr-deref in target_alloc_device() 2024-11-01 01:56:00 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:49:17 +02:00
thermal thermal: int3400: Fix reading of current_uuid for active policy 2024-12-14 19:54:15 +01:00
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-08-29 17:30:13 +02:00
tty serial: amba-pl011: fix build regression 2024-12-14 19:54:55 +01:00
ufs scsi: ufs: core: Make DMA mask configuration more flexible 2024-12-14 19:54:46 +01:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:10:26 +02:00
usb usb: dwc3: ep0: Don't reset resource alloc flag 2024-12-14 19:54:55 +01:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-14 19:53:48 +01:00
vfio vfio/mlx5: Align the page tracking max message size with the device capability 2024-12-14 19:54:51 +01:00
vhost vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 2024-10-17 15:22:09 +02:00
video fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-12-14 19:53:42 +01:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:03:30 +02:00
virtio vdpa: Add eventfd for the vdpa callback 2024-10-17 15:21:12 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: rti: of: honor timeout-sec property 2024-12-14 19:54:32 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-14 19:53:54 +01:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00