From 07452ef620d930ec54a5bba4af41ef219d861787 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Fri, 12 May 2023 16:18:00 +0100 Subject: [PATCH 01/10] UPSTREAM: media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() [ Upstream commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 ] Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/ Bug: 290204413 Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de Reported-by: Yu Hao Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084 Signed-off-by: Takashi Iwai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin (cherry picked from commit d0088ea444e676a0c75551efe183bee4a3d2cfc8) Signed-off-by: Lee Jones Change-Id: Id9420d5cf7676aec6c565013cc00f0cc6f05732d From f38754f7336474b5be6745c90563e6c32b921793 Mon Sep 17 00:00:00 2001 From: M A Ramdhan Date: Wed, 5 Jul 2023 12:15:30 -0400 Subject: [PATCH 02/10] UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free [ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ] In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Bug: 292252062 Bug: 290783303 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan Signed-off-by: M A Ramdhan Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg> Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit c91fb29bb07ee4dd40aabd1e41f19c0f92ac3199) Signed-off-by: Lee Jones Change-Id: I9bf6f540b4eb23ea5641fb3efe6f3e621d7b6151 --- net/sched/cls_fw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index ec945294626a..41f0898a5a56 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - if (tb[TCA_FW_INDEV]) { int ret; ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); @@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; } From e4b912f6122685e207900033dfa1c116b905d356 Mon Sep 17 00:00:00 2001 From: valis Date: Sat, 29 Jul 2023 08:32:00 -0400 Subject: [PATCH 03/10] UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free [ Upstream commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81 ] When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Bug: 296347075 Fixes: de5df63228fc ("net: sched: cls_u32 changes to knode must appear atomic to readers") Reported-by: valis Reported-by: M A Ramdhan Signed-off-by: valis Signed-off-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: M A Ramdhan Link: https://lore.kernel.org/r/20230729123202.72406-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit aab2d095ce4dd8d01ca484c0cc641fb497bf74db) Signed-off-by: Lee Jones Change-Id: I1a8381c308cc97cf61d6f95a02992d2c553455c5 --- net/sched/cls_u32.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index e5cc2b4d38d5..0995972e045f 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -814,7 +814,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, new->ifindex = n->ifindex; new->fshift = n->fshift; - new->res = n->res; new->flags = n->flags; RCU_INIT_POINTER(new->ht_down, ht); From ac9e6cd126223d49b7d6e48bfc1be524ff07db6d Mon Sep 17 00:00:00 2001 From: valis Date: Sat, 29 Jul 2023 08:32:01 -0400 Subject: [PATCH 04/10] UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free [ Upstream commit 76e42ae831991c828cffa8c37736ebfb831ad5ec ] When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Bug: 296347075 Fixes: e35a8ee5993b ("net: sched: fw use RCU") Reported-by: valis Reported-by: Bing-Jhong Billy Jheng Signed-off-by: valis Signed-off-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: M A Ramdhan Link: https://lore.kernel.org/r/20230729123202.72406-3-jhs@mojatatu.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit 7f691439b29be0aae68f83ad5eecfddc11007724) Signed-off-by: Lee Jones Change-Id: I33c91c83d1cd8e889a7261adfa3779ca6c141088 --- net/sched/cls_fw.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index 41f0898a5a56..08c41f1976c4 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -266,7 +266,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb, return -ENOBUFS; fnew->id = f->id; - fnew->res = f->res; fnew->ifindex = f->ifindex; fnew->tp = f->tp; From 212a7aaded26d928452b1d4bc1c756fb3bfbf782 Mon Sep 17 00:00:00 2001 From: valis Date: Sat, 29 Jul 2023 08:32:02 -0400 Subject: [PATCH 05/10] UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free [ Upstream commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 ] When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Bug: 296347075 Fixes: 1109c00547fc ("net: sched: RCU cls_route") Reported-by: valis Reported-by: Bing-Jhong Billy Jheng Signed-off-by: valis Signed-off-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: M A Ramdhan Link: https://lore.kernel.org/r/20230729123202.72406-4-jhs@mojatatu.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit d4d3b53a4c66004e8e864fea744b3a2b86a73b62) Signed-off-by: Lee Jones Change-Id: Iefbd201b92847ec1349f92c107d7ef5aec3fb359 --- net/sched/cls_route.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index b775e681cb56..1ad4b3e60eb3 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, if (fold) { f->id = fold->id; f->iif = fold->iif; - f->res = fold->res; f->handle = fold->handle; f->tp = fold->tp; From 657abd3d2bdbe0a39641cf519334d4135290a92a Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Mon, 31 Jul 2023 18:42:36 +0200 Subject: [PATCH 06/10] UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid() commit 9bc3047374d5bec163e83e743709e23753376f0c upstream. Commit a096ccca6e50 initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/net/tun" device node's owner UID. Per original commit 86741ec25462 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec25462 mentions socket() and accept(); with "tun", the action that creates the socket is open("/dev/net/tun"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/net/tun" will be owned by root, so in practice, commit a096ccca6e50 has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/net/tun" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Bug: 295995961 Cc: Eric Dumazet Cc: Lorenzo Colitti Cc: Paolo Abeni Cc: Pietro Borrello Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman (cherry picked from commit b6846d7c408b33e4701f4f5ca28932e2a08e0a2e) Signed-off-by: Lee Jones Change-Id: I2540ac5876ca7dad39e1b867a5e09a5c9c69bb86 --- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a4e44f98fbc3..309a0dd16bdc 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3534,7 +3534,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) tfile->socket.file = file; tfile->socket.ops = &tun_socket_ops; - sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid); + sock_init_data_uid(&tfile->socket, &tfile->sk, current_fsuid()); tfile->sk.sk_write_space = tun_sock_write_space; tfile->sk.sk_sndbuf = INT_MAX; From d62f1fc1623efbeb110e393379097ee39766655d Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Mon, 31 Jul 2023 18:42:37 +0200 Subject: [PATCH 07/10] UPSTREAM: net: tap_open(): set sk_uid from current_fsuid() commit 5c9241f3ceab3257abe2923a59950db0dc8bb737 upstream. Commit 66b2c338adce initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/tapX" device node's owner UID. Per original commit 86741ec25462 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec25462 mentions socket() and accept(); with "tap", the action that creates the socket is open("/dev/tapX"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/tapX" will be owned by root, so in practice, commit 66b2c338adce has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/tapX" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Bug: 295995961 Cc: Eric Dumazet Cc: Lorenzo Colitti Cc: Paolo Abeni Cc: Pietro Borrello Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 66b2c338adce ("tap: tap_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 767800fc402deac438c5aed9c82f0e71a70c86fd) Signed-off-by: Lee Jones Change-Id: Ib5f80015e5c0280acf9f35124d3ff267ff0420f0 --- drivers/net/tap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index 574c17aa4b09..c299faaf4b2d 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -525,7 +525,7 @@ static int tap_open(struct inode *inode, struct file *file) q->sock.state = SS_CONNECTED; q->sock.file = file; q->sock.ops = &tap_socket_ops; - sock_init_data_uid(&q->sock, &q->sk, inode->i_uid); + sock_init_data_uid(&q->sock, &q->sk, current_fsuid()); q->sk.sk_write_space = tap_sock_write_space; q->sk.sk_destruct = tap_sock_destruct; q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; From 28e9ee34f71af1d03fd121d13cf87e0c1e9427ea Mon Sep 17 00:00:00 2001 From: Srinivasarao Pathipati Date: Wed, 23 Aug 2023 15:53:47 +0530 Subject: [PATCH 08/10] ANDROID: ABI: Update allowed list for QCOM Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function int sysfs_emit(char*, const char*, ...)' Bug: 297153855 Change-Id: Ia8be1195062a8e64b3b8158c00196718e862b0aa Signed-off-by: Srinivasarao Pathipati --- android/abi_gki_aarch64.xml | 4306 +++++++++++++++++----------------- android/abi_gki_aarch64_qcom | 1 + 2 files changed, 2109 insertions(+), 2198 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index c218ef5a2e75..ff82075ff092 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -4123,6 +4123,7 @@ + @@ -6238,12 +6239,12 @@ - + - + - + @@ -15738,411 +15739,411 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -16798,10 +16799,10 @@ - + - + @@ -20139,12 +20140,12 @@ - + - + - + @@ -20250,7 +20251,7 @@ - + @@ -20259,7 +20260,7 @@ - + @@ -20496,18 +20497,18 @@ - + - + - + - + - + @@ -20945,12 +20946,12 @@ - + - + - + @@ -21534,18 +21535,18 @@ - + - + - + - + - + @@ -21897,44 +21898,44 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -23322,12 +23323,12 @@ - + - + - + @@ -24776,228 +24777,228 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -25027,32 +25028,32 @@ - + - + - + - + - + - + - + - + - + - + @@ -25197,165 +25198,165 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -26455,12 +26456,12 @@ - + - + - + @@ -28689,18 +28690,18 @@ - + - + - + - + - + @@ -30130,18 +30131,18 @@ - + - + - + - + - + @@ -30154,7 +30155,7 @@ - + @@ -31639,23 +31640,7 @@ - - - - - - - - - - - - - - - - - + @@ -32090,7 +32075,7 @@ - + @@ -32553,7 +32538,7 @@ - + @@ -32604,11 +32589,6 @@ - - - - - @@ -34669,411 +34649,411 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -48534,24 +48514,24 @@ - + - + - + - + - + - + - + @@ -49400,21 +49380,7 @@ - - - - - - - - - - - - - - @@ -49429,39 +49395,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -51184,20 +51117,20 @@ - + - + - + - + - + - + @@ -51272,228 +51205,228 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -51848,7 +51781,7 @@ - + @@ -52009,23 +51942,23 @@ - + - + - + - + - + - + - + @@ -52035,42 +51968,42 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -52581,12 +52514,12 @@ - + - + - + @@ -53515,36 +53448,36 @@ - + - + - + - + - + - + - + - + - + - + - + @@ -53697,29 +53630,29 @@ - + - + - + - + - + - + - + - + - + @@ -53728,7 +53661,7 @@ - + @@ -53739,55 +53672,55 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -56013,14 +55946,14 @@ - - - + + + - - - + + + @@ -58840,30 +58773,30 @@ - - - - + + + + - - - - + + + + - - - + + + - - + + - - - + + + @@ -60739,10 +60672,10 @@ - - - - + + + + @@ -60778,77 +60711,77 @@ - - - - - + + + + + - - - - - - - + + + + + + + - - - - - + + + + + - - - - + + + + - - - - + + + + - - - - - + + + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - + + - - + + - - + + @@ -64566,7 +64499,7 @@ - + @@ -64650,7 +64583,7 @@ - + @@ -65997,7 +65930,7 @@ - + @@ -67858,21 +67791,21 @@ - + - + - + - + - + - + @@ -69161,7 +69094,7 @@ - + @@ -81611,9 +81544,9 @@ - - - + + + @@ -81640,47 +81573,47 @@ - - + + - - + + - - - - + + + + - - - + + + - - - - + + + + - - - + + + - - - - - + + + + + - - - - + + + + @@ -83719,28 +83652,28 @@ - - + + - - + + - - + + - - + + - - + + @@ -86561,18 +86494,18 @@ - + - + - + @@ -86966,11 +86899,11 @@ - + - + @@ -88916,7 +88849,7 @@ - + @@ -89882,14 +89815,14 @@ - + - + @@ -89910,217 +89843,217 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -90199,7 +90132,7 @@ - + @@ -90235,78 +90168,78 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -90335,59 +90268,59 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -90421,39 +90354,39 @@ - + - + - + - + - + - + - + - + - + - + - + - + @@ -90486,9 +90419,9 @@ - + - + @@ -90711,15 +90644,15 @@ - + - + - + - + @@ -90990,7 +90923,7 @@ - + @@ -91050,7 +90983,7 @@ - + @@ -92171,12 +92104,12 @@ - + - + - + @@ -93412,62 +93345,62 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -94008,48 +93941,48 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -94057,24 +93990,24 @@ - + - + - + - + - + - + - + @@ -94732,9 +94665,9 @@ - - - + + + @@ -107757,7 +107690,7 @@ - + @@ -107770,11 +107703,11 @@ - + - + @@ -107784,7 +107717,7 @@ - + @@ -107793,11 +107726,11 @@ - + - + @@ -109068,7 +109001,7 @@ - + @@ -109364,7 +109297,7 @@ - + @@ -109373,7 +109306,7 @@ - + @@ -109386,7 +109319,7 @@ - + @@ -109396,7 +109329,7 @@ - + @@ -109404,12 +109337,12 @@ - + - + @@ -109432,7 +109365,7 @@ - + @@ -109448,11 +109381,11 @@ - + - + @@ -109467,7 +109400,7 @@ - + @@ -109481,7 +109414,7 @@ - + @@ -109491,11 +109424,11 @@ - + - + @@ -109865,7 +109798,7 @@ - + @@ -109881,17 +109814,17 @@ - + - + - + @@ -110300,21 +110233,21 @@ - + - + - + - + - + - + @@ -110364,128 +110297,128 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -110858,18 +110791,18 @@ - + - + - + @@ -110885,85 +110818,85 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -111020,39 +110953,39 @@ - + - + - + - + - + - + - + - + - + - + - + - + @@ -111074,69 +111007,69 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -111413,211 +111346,211 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -111642,83 +111575,83 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -111765,36 +111698,36 @@ - + - + - + - + - + - + - + - + - + - + - + @@ -111905,27 +111838,27 @@ - + - + - + - + - + - + - + - + @@ -111954,196 +111887,196 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + + - + - + - + - + @@ -112214,11 +112147,11 @@ - + - + @@ -112230,7 +112163,7 @@ - + @@ -112240,7 +112173,7 @@ - + @@ -112253,11 +112186,11 @@ - + - + @@ -112266,19 +112199,19 @@ - + - + - + @@ -112286,26 +112219,26 @@ - + - + - + - + - + @@ -112315,21 +112248,21 @@ - + - + - + - + @@ -112337,7 +112270,7 @@ - + @@ -112354,7 +112287,7 @@ - + @@ -112392,7 +112325,7 @@ - + @@ -112404,19 +112337,19 @@ - + - + - + - + @@ -112469,7 +112402,7 @@ - + @@ -112543,16 +112476,16 @@ - + - + - + @@ -113035,165 +112968,165 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -113307,18 +113240,18 @@ - + - + - + - + - + @@ -114767,12 +114700,12 @@ - + - + - + @@ -116200,7 +116133,7 @@ - + @@ -116209,7 +116142,7 @@ - + @@ -116221,7 +116154,7 @@ - + @@ -116253,10 +116186,10 @@ - + - + @@ -116264,14 +116197,14 @@ - + - + @@ -120132,7 +120065,7 @@ - + @@ -121070,7 +121003,7 @@ - + @@ -121297,7 +121230,7 @@ - + @@ -121313,7 +121246,7 @@ - + @@ -121338,7 +121271,7 @@ - + @@ -121548,70 +121481,70 @@ - - + + - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - + + - - + + @@ -121926,9 +121859,9 @@ - - - + + + @@ -121939,54 +121872,54 @@ - - - + + + - - - + + + - - + + - - + + - - - - - - + + - - + + - - - + + - - + + + + + + + - - - - + + + + - - + + @@ -122001,56 +121934,56 @@ - - - - + + + + - - - - + + + + - - - - + + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - - + + + - - - - + + + + @@ -122065,16 +121998,16 @@ - - + + - - + + - - + + @@ -129725,22 +129658,22 @@ - - - + + + - - + + - - + + - - - + + + @@ -130541,7 +130474,7 @@ - + @@ -132019,11 +131952,11 @@ - + - + @@ -132212,11 +132145,11 @@ - + - + @@ -134537,7 +134470,7 @@ - + @@ -134563,7 +134496,7 @@ - + @@ -134580,7 +134513,7 @@ - + @@ -134591,7 +134524,7 @@ - + @@ -134603,7 +134536,7 @@ - + @@ -134627,7 +134560,7 @@ - + @@ -134659,7 +134592,7 @@ - + @@ -134672,13 +134605,13 @@ - + - + @@ -134723,7 +134656,7 @@ - + @@ -134776,7 +134709,7 @@ - + @@ -134800,11 +134733,11 @@ - - - - - + + + + + @@ -135163,18 +135096,18 @@ - + - + - + - + - + @@ -136219,7 +136152,7 @@ - + @@ -136230,33 +136163,33 @@ - + - + - + - + - + - + - + - + - + - + @@ -136338,45 +136271,45 @@ - - - + + + - - - + + + - - - + + + - - - - + + + + - - + + - - + + - - + + - - - - - - + + + + + + @@ -138867,7 +138800,7 @@ - + @@ -139255,16 +139188,16 @@ - + - - - + + + @@ -139663,7 +139596,7 @@ - + @@ -139690,7 +139623,7 @@ - + @@ -139700,7 +139633,7 @@ - + @@ -139725,7 +139658,7 @@ - + @@ -140396,7 +140329,7 @@ - + @@ -140975,15 +140908,15 @@ - + - + - + @@ -141268,7 +141201,7 @@ - + @@ -141285,7 +141218,7 @@ - + @@ -141300,7 +141233,7 @@ - + @@ -141319,7 +141252,7 @@ - + @@ -141339,7 +141272,7 @@ - + @@ -141351,7 +141284,7 @@ - + @@ -141360,12 +141293,12 @@ - + - + @@ -141374,7 +141307,7 @@ - + @@ -141386,11 +141319,11 @@ - + - + @@ -142597,9 +142530,9 @@ - - - + + + @@ -142607,25 +142540,25 @@ - - - + + + - - + + - - + + - - + + - - + + @@ -142636,8 +142569,8 @@ - - + + @@ -145010,7 +144943,7 @@ - + @@ -146929,7 +146862,7 @@ - + @@ -147246,7 +147179,7 @@ - + @@ -147883,24 +147816,24 @@ - + - + - + - + - + - + - + @@ -148067,7 +148000,7 @@ - + @@ -148148,18 +148081,18 @@ - + - + - + - + - + @@ -148692,7 +148625,7 @@ - + @@ -150273,55 +150206,55 @@ - - - + + + - - - - - - + + + + + + - - - + + + - - + + - - - + + + - - - - - - + + + + + + - - - - + + + + - - - - + + + + @@ -150749,6 +150682,12 @@ + + + + + + @@ -152972,12 +152911,12 @@ - + - + - + @@ -153186,20 +153125,7 @@ - - - - - - - - - - - - - - + @@ -153416,18 +153342,18 @@ - + - + - + - + - + @@ -153834,23 +153760,7 @@ - - - - - - - - - - - - - - - - - + @@ -158422,10 +158332,10 @@ - + - + @@ -164397,18 +164307,18 @@ - + - + - + - + - + @@ -164440,12 +164350,12 @@ - - + + - - + + @@ -165886,7 +165796,7 @@ - + @@ -166207,38 +166117,38 @@ - - - + + + - - + + - - + + - - - - + + + + - - - - + + + + - - - + + + @@ -166249,38 +166159,38 @@ - - - + + + - - - - - + + + + + - - - + + + - - - + + + - - - - + + + + - - - - + + + + @@ -166297,9 +166207,9 @@ - - - + + + @@ -166536,9 +166446,9 @@ - - - + + + @@ -166550,9 +166460,9 @@ - - - + + + @@ -167158,129 +167068,129 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -167291,22 +167201,22 @@ - - + + - - - + + + - - - + + + - + @@ -167371,106 +167281,106 @@ - - - + + + - - - + + + - - - - + + + + - - - - + + + + - - + + - - - - + + + + - - + + - - - - + + + + - - + + - - - + + + - - + + - - + + - - - - + + + + - - - - - - + + + + + + - - - + + + - - + + - - - + + + - - + + - - - - + + + + - - - + + + @@ -167710,8 +167620,8 @@ - - + + @@ -167794,9 +167704,9 @@ - - - + + + @@ -167812,7 +167722,7 @@ - + @@ -168048,29 +167958,29 @@ - + - + - + - + - + - + - + - + - + @@ -168090,11 +168000,11 @@ - + - + @@ -168173,7 +168083,7 @@ - + @@ -171437,7 +171347,7 @@ - + @@ -171559,7 +171469,7 @@ - + @@ -171995,7 +171905,7 @@ - + @@ -175192,7 +175102,7 @@ - + @@ -176932,7 +176842,7 @@ - + @@ -176986,7 +176896,7 @@ - + @@ -177070,7 +176980,7 @@ - + @@ -177749,27 +177659,27 @@ - - - - - + + + + + - - - - - - - + + + + + + + - - - - - + + + + + @@ -178533,7 +178443,7 @@ - + @@ -179302,6 +179212,157 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -179355,6 +179416,91 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -179369,24 +179515,6 @@ - - - - - - - - - - - - - - - - - - @@ -179489,29 +179617,6 @@ - - - - - - - - - - - - - - - - - - - - - - - @@ -179782,201 +179887,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -179991,7 +179901,7 @@ - + @@ -180020,7 +179930,7 @@ - + @@ -180612,7 +180522,7 @@ - + @@ -181572,7 +181482,7 @@ - + @@ -184037,7 +183947,7 @@ - + @@ -184157,7 +184067,7 @@ - + @@ -184901,7 +184811,7 @@ - + @@ -184922,7 +184832,7 @@ - + diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index c627b081fe81..a828ca6ceaf3 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -2439,6 +2439,7 @@ sysfs_create_group sysfs_create_groups sysfs_create_link + sysfs_emit __sysfs_match_string sysfs_notify sysfs_remove_bin_file From 118240f14b95bf9d42522115289c20e7d27de968 Mon Sep 17 00:00:00 2001 From: Sungwoo Kim Date: Wed, 31 May 2023 01:39:56 -0400 Subject: [PATCH 09/10] UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb commit 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 upstream. l2cap_sock_release(sk) frees sk. However, sk's children are still alive and point to the already free'd sk's address. To fix this, l2cap_sock_release(sk) also cleans sk's children. ================================================================== BUG: KASAN: use-after-free in l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650 Read of size 8 at addr ffff888104617aa8 by task kworker/u3:0/276 CPU: 0 PID: 276 Comm: kworker/u3:0 Not tainted 6.2.0-00001-gef397bd4d5fb-dirty #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci2 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0x95 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x175/0x478 mm/kasan/report.c:417 kasan_report+0xb1/0x130 mm/kasan/report.c:517 l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650 l2cap_chan_ready+0x10e/0x1e0 net/bluetooth/l2cap_core.c:1386 l2cap_config_req+0x753/0x9f0 net/bluetooth/l2cap_core.c:4480 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5739 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:6509 [inline] l2cap_recv_frame+0xe2e/0x43c0 net/bluetooth/l2cap_core.c:7788 l2cap_recv_acldata+0x6ed/0x7e0 net/bluetooth/l2cap_core.c:8506 hci_acldata_packet net/bluetooth/hci_core.c:3813 [inline] hci_rx_work+0x66e/0xbc0 net/bluetooth/hci_core.c:4048 process_one_work+0x4ea/0x8e0 kernel/workqueue.c:2289 worker_thread+0x364/0x8e0 kernel/workqueue.c:2436 kthread+0x1b9/0x200 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 Allocated by task 288: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0x140 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x113/0x1f0 net/core/sock.c:2040 sk_alloc+0x36/0x3c0 net/core/sock.c:2093 l2cap_sock_alloc.constprop.0+0x39/0x1c0 net/bluetooth/l2cap_sock.c:1852 l2cap_sock_create+0x10d/0x220 net/bluetooth/l2cap_sock.c:1898 bt_sock_create+0x183/0x290 net/bluetooth/af_bluetooth.c:132 __sock_create+0x226/0x380 net/socket.c:1518 sock_create net/socket.c:1569 [inline] __sys_socket_create net/socket.c:1606 [inline] __sys_socket_create net/socket.c:1591 [inline] __sys_socket+0x112/0x200 net/socket.c:1639 __do_sys_socket net/socket.c:1652 [inline] __se_sys_socket net/socket.c:1650 [inline] __x64_sys_socket+0x40/0x50 net/socket.c:1650 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 288: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:523 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free mm/kasan/common.c:200 [inline] __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x88/0x1f0 mm/slub.c:3800 sk_prot_free net/core/sock.c:2076 [inline] __sk_destruct+0x347/0x430 net/core/sock.c:2168 sk_destruct+0x9c/0xb0 net/core/sock.c:2183 __sk_free+0x82/0x220 net/core/sock.c:2194 sk_free+0x7c/0xa0 net/core/sock.c:2205 sock_put include/net/sock.h:1991 [inline] l2cap_sock_kill+0x256/0x2b0 net/bluetooth/l2cap_sock.c:1257 l2cap_sock_release+0x1a7/0x220 net/bluetooth/l2cap_sock.c:1428 __sock_release+0x80/0x150 net/socket.c:650 sock_close+0x19/0x30 net/socket.c:1368 __fput+0x17a/0x5c0 fs/file_table.c:320 task_work_run+0x132/0x1c0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:296 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff888104617800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 680 bytes inside of 1024-byte region [ffff888104617800, ffff888104617c00) The buggy address belongs to the physical page: page:00000000dbca6a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888104614000 pfn:0x104614 head:00000000dbca6a80 order:2 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffff888100041dc0 ffffea0004212c10 ffffea0004234b10 raw: ffff888104614000 0000000000080002 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888104617980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888104617a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888104617a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888104617b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888104617b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Bug: 297025149 Ack: This bug is found by FuzzBT with a modified Syzkaller. Other contributors are Ruoyu Wu and Hui Peng. Signed-off-by: Sungwoo Kim Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 29fac18499332211b2615ade356e2bd8b3269f98) Signed-off-by: Lee Jones Change-Id: I1f4cf5a928b4825c63488bde0d5589517cc84ef8 --- net/bluetooth/l2cap_sock.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 0fa5ced767a2..712bffa4e8b4 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops; static void l2cap_sock_init(struct sock *sk, struct sock *parent); static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern); +static void l2cap_sock_cleanup_listen(struct sock *parent); bool l2cap_is_socket(struct socket *sock) { @@ -1224,6 +1225,7 @@ static int l2cap_sock_release(struct socket *sock) if (!sk) return 0; + l2cap_sock_cleanup_listen(sk); bt_sock_unlink(&l2cap_sk_list, sk); err = l2cap_sock_shutdown(sock, 2); From d57e792d0bd90ffe14380ee16bb98914e3d1f15c Mon Sep 17 00:00:00 2001 From: Duoming Zhou Date: Tue, 23 May 2023 07:59:32 +0800 Subject: [PATCH 10/10] UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer [ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ] The previous commit ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") adds cancel_work_sync() in smsusb_stop_streaming(). But smsusb_stop_streaming() may be called, even if the work_struct surb->wq has not been initialized. As a result, the warning will occur. One of the processes that could lead to warning is shown below: smsusb_probe() smsusb_init_device() if (!dev->in_ep || !dev->out_ep || align < 0) { smsusb_term_device(intf); smsusb_stop_streaming() cancel_work_sync(&dev->surbs[i].wq); __cancel_work_timer() __flush_work() if (WARN_ON(!work->func)) // work->func is null The log reported by syzbot is shown below: WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063 Modules linked in: CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0 RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066 ... RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246 RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8 RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8 R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160 smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline] smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344 smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419 smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567 ... This patch adds check before cancel_work_sync(). If surb->wq has not been initialized, the cancel_work_sync() will not be executed. Bug: 295075980 Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") Signed-off-by: Duoming Zhou Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin (cherry picked from commit 8abb53c5167cfb5bb275512a3da4ec2468478626) Signed-off-by: Lee Jones Change-Id: Ie2946408cfde466d0138c23093ec6738b7e51161 --- drivers/media/usb/siano/smsusb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c index 1db232a1063b..0358cd104387 100644 --- a/drivers/media/usb/siano/smsusb.c +++ b/drivers/media/usb/siano/smsusb.c @@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) for (i = 0; i < MAX_URBS; i++) { usb_kill_urb(&dev->surbs[i].urb); - cancel_work_sync(&dev->surbs[i].wq); + if (dev->surbs[i].wq.func) + cancel_work_sync(&dev->surbs[i].wq); if (dev->surbs[i].cb) { smscore_putbuffer(dev->coredev, dev->surbs[i].cb);