No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Tong Zhang 1e3ad91cb6 memstick: rtsx_usb_ms: fix UAF
[ Upstream commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 ]

This patch fixes the following issues:
1. memstick_free_host() will free the host, so the use of ms_dev(host) after
it will be a problem. To fix this, move memstick_free_host() after when we
are done with ms_dev(host).
2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove
and free host otherwise memstick_check will be called and UAF will
happen.

[   11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357077]  rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357376]  platform_remove+0x2a/0x50
[   11.367531] Freed by task 298:
[   11.368537]  kfree+0xa4/0x2a0
[   11.368711]  device_release+0x51/0xe0
[   11.368905]  kobject_put+0xa2/0x120
[   11.369090]  rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms]
[   11.369386]  platform_remove+0x2a/0x50

[   12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0
[   12.045432]  mutex_lock+0xc9/0xd0
[   12.046080]  memstick_check+0x6a/0x578 [memstick]
[   12.046509]  process_one_work+0x46d/0x750
[   12.052107] Freed by task 297:
[   12.053115]  kfree+0xa4/0x2a0
[   12.053272]  device_release+0x51/0xe0
[   12.053463]  kobject_put+0xa2/0x120
[   12.053647]  rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms]
[   12.053939]  platform_remove+0x2a/0x50

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Co-developed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:53:13 +02:00
arch powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi() 2021-07-14 16:53:08 +02:00
block blk-mq: Swap two calls in blk_mq_exit_queue() 2021-05-19 10:08:30 +02:00
certs certs: Move load_system_certificate_list to a common function 2021-06-30 08:47:55 -04:00
crypto crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS 2021-05-11 14:04:15 +02:00
Documentation evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded 2021-07-14 16:53:08 +02:00
drivers memstick: rtsx_usb_ms: fix UAF 2021-07-14 16:53:13 +02:00
fs fuse: reject internal errno 2021-07-14 16:53:09 +02:00
include tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing 2021-07-14 16:53:08 +02:00
init kbuild: add CONFIG_LD_IS_LLD 2021-06-30 08:47:44 -04:00
ipc
kernel sched/fair: Fix ascii art by relpacing tabs 2021-07-14 16:53:12 +02:00
lib seq_buf: Make trace_seq_putmem_hex() support data longer than 8 2021-07-14 16:53:08 +02:00
LICENSES
mm mm, futex: fix shared futex pgoff on shmem huge page 2021-06-30 08:47:55 -04:00
net SUNRPC: Should wake up the privileged task firstly. 2021-07-14 16:53:05 +02:00
samples samples: vfio-mdev: fix error handing in mdpy_fb_probe() 2021-06-10 13:37:03 +02:00
scripts Makefile: fix GDB warning with CONFIG_RELR 2021-07-14 16:53:12 +02:00
security evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded 2021-07-14 16:53:08 +02:00
sound ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too 2021-07-14 16:52:59 +02:00
tools KVM: selftests: Fix kvm_check_cap() assertion 2021-06-30 08:47:49 -04:00
usr
virt KVM: do not allow mapping valid but non-reference-counted pages 2021-06-30 08:47:50 -04:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Makefile: fix GDB warning with CONFIG_RELR 2021-07-14 16:53:12 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.