Duoming Zhou
fde6e73189
cnic: Fix use-after-free bugs in cnic_delete_task ...
[ Upstream commit cfa7d9b1e3a8604afc84e9e51d789c29574fb216 ]
The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),
which does not guarantee that the delayed work item 'delete_task' has
fully completed if it was already running. Additionally, the delayed work
item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only
blocks and waits for work items that were already queued to the
workqueue prior to its invocation. Any work items submitted after
flush_workqueue() is called are not included in the set of tasks that the
flush operation awaits. This means that after the cyclic work items have
finished executing, a delayed work item may still exist in the workqueue.
This leads to use-after-free scenarios where the cnic_dev is deallocated
by cnic_free_dev(), while delete_task remains active and attempt to
dereference cnic_dev in cnic_delete_task().
A typical race condition is illustrated below:
CPU 0 (cleanup) | CPU 1 (delayed work callback)
cnic_netdev_event() |
cnic_stop_hw() | cnic_delete_task()
cnic_cm_stop_bnx2x_hw() | ...
cancel_delayed_work() | /* the queue_delayed_work()
flush_workqueue() | executes after flush_workqueue()*/
| queue_delayed_work()
cnic_free_dev(dev)//free | cnic_delete_task() //new instance
| dev = cp->dev; //use
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the cyclic delayed work item is properly canceled and that any
ongoing execution of the work item completes before the cnic_dev is
deallocated. Furthermore, since cancel_delayed_work_sync() uses
__flush_work(work, true) to synchronously wait for any currently
executing instance of the work item to finish, the flush_workqueue()
becomes redundant and should be removed.
This bug was identified through static analysis. To reproduce the issue
and validate the fix, I simulated the cnic PCI device in QEMU and
introduced intentional delays — such as inserting calls to ssleep()
within the cnic_delete_task() function — to increase the likelihood
of triggering the bug.
Fixes: fdf24086f4
2025-10-02 13:34:31 +02:00
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
2025-08-28 16:21:33 +02:00
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
2025-08-28 16:21:35 +02:00
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
2025-09-04 14:05:54 +02:00
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
2025-08-28 16:21:34 +02:00
drbd: add missing kref_get in handle_write_conflicts
2025-08-28 16:21:24 +02:00
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
2025-06-27 11:02:55 +01:00
ipmi: Fix strcpy source and destination the same
2025-08-28 16:21:29 +02:00
clk: sunxi-ng: v3s: Fix de clock definition
2025-08-28 16:21:20 +02:00
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
2025-06-04 14:32:29 +02:00
counter: stm32-lptimer-cnt: fix error handling when enabling
2025-04-10 14:29:39 +02:00
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
2025-08-28 16:21:30 +02:00
cpuidle: menu: Avoid discarding useful information
2025-06-04 14:32:32 +02:00
crypto: qat - fix seq_file position update in adf_ring_next()
2025-08-28 16:21:21 +02:00
dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
2025-10-02 13:34:29 +02:00
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
2025-07-17 18:25:04 +02:00
EDAC/altera: Delete an inappropriate dma_free_coherent() call
2025-10-02 13:34:27 +02:00
firmware: psci: Fix refcount leak in psci_dt_init
2025-06-27 11:02:46 +01:00
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
2025-08-28 16:21:32 +02:00
gpio: pca953x: fix IRQ storm on system wake up
2025-09-09 18:44:00 +02:00
drm/amdgpu: drop hw access in non-DC audio fini
2025-09-09 18:43:59 +02:00
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
2025-09-04 14:05:56 +02:00
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
2025-04-10 14:29:35 +02:00
hwmon: (occ) fix unaligned accesses
2025-06-27 11:02:57 +01:00
coresight: catu: Fix number of pages while using 64k pages
2025-04-10 14:29:41 +02:00
i2c: qup: jump out of the loop in case of timeout
2025-08-28 16:21:17 +02:00
i3c: don't fail if GETHDRCAP is unsupported
2025-08-28 16:21:29 +02:00
iio: light: opt3001: fix deadlock due to concurrent flag access
2025-09-09 18:44:00 +02:00
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
2025-08-28 16:21:28 +02:00
Input: xpad - set correct controller type for Acer NGR200
2025-08-28 16:21:14 +02:00
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
2025-06-04 14:32:26 +02:00
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
2025-06-04 14:32:25 +02:00
mISDN: Fix memory leak in dsp_hwec_enable()
2025-09-09 18:43:57 +02:00
mailbox: Not protect module_put with spin_lock_irqsave
2025-07-17 18:24:49 +02:00
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
md/raid1: Fix stack memory use after return in raid1_reshape
2025-07-17 18:25:04 +02:00
media: venus: hfi: explicitly release IRQ during teardown
2025-08-28 16:21:35 +02:00
memstick: Fix deadlock by moving removing flag earlier
2025-08-28 16:21:32 +02:00
mfd: max14577: Fix wakeup source leaks on device unbind
2025-07-17 18:24:49 +02:00
misc: rtsx: usb: Ensure mmc child device is active when card is present
2025-08-28 16:21:30 +02:00
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
2025-08-28 16:21:25 +02:00
mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
2025-10-02 13:34:28 +02:00
cnic: Fix use-after-free bugs in cnic_delete_task
2025-10-02 13:34:31 +02:00
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
of: module: add buffer overflow check in of_modalias()
2025-06-04 14:32:25 +02:00
parport_pc: add support for ASIX AX99100
2025-03-13 12:43:19 +01:00
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
2025-08-28 16:21:33 +02:00
pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
2025-10-02 13:34:30 +02:00
perf: arm_pmu: Don't disable counter in armpmu_add()
2025-05-02 07:39:09 +02:00
phy: ti-pipe3: fix device leak at unbind
2025-10-02 13:34:30 +02:00
pinctrl: STMFX: add missing HAS_IOMEM dependency
2025-09-04 14:05:53 +02:00
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
2025-08-28 16:21:25 +02:00
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
2025-08-28 16:21:20 +02:00
powercap: call put_device() on an error path in powercap_register_control_type()
2025-04-10 14:29:36 +02:00
pps: fix poll support
2025-08-28 16:21:18 +02:00
pwm: mediatek: Fix duty and period setting
2025-08-28 16:21:35 +02:00
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
2025-06-27 11:02:56 +01:00
regulator: core: fix NULL dereference on unbind due to stale coupling data
2025-08-28 16:21:17 +02:00
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
2025-06-27 11:02:48 +01:00
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
2025-08-28 16:21:35 +02:00
scsi: s390: zfcp: Ensure synchronous unit_add
2025-06-27 11:02:56 +01:00
scsi: lpfc: Fix buffer free/clear order in deferred receive path
2025-09-09 18:43:59 +02:00
slimbus: messaging: Free transaction ID in delayed interrupt scenario
2025-03-13 12:43:33 +01:00
soc: qcom: mdt_loader: Deal with zero e_shentsize
2025-10-02 13:34:30 +02:00
soundwire: stream: restore params when prepare ports fail
2025-08-28 16:21:21 +02:00
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
2025-09-09 18:44:01 +02:00
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
2025-08-28 16:21:33 +02:00
scsi: target: iscsi: Fix timeout on deleted connection
2025-06-04 14:32:29 +02:00
tee: Prevent size calculation wraparound on 32-bit kernels
2025-06-27 11:02:55 +01:00
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
2025-08-28 16:21:25 +02:00
thunderbolt: Fix copy+paste error in match_service_id()
2025-08-28 16:21:30 +02:00
tty: hvc_console: Call hvc_kick in hvc_write unconditionally
2025-10-02 13:34:28 +02:00
uio_hv_generic: Use correct size for interrupt and monitor pages
2025-06-27 11:02:52 +01:00
USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
2025-10-02 13:34:28 +02:00
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
2025-09-04 14:05:53 +02:00
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
2025-08-28 16:21:31 +02:00
watchdog: dw_wdt: Fix default timeout
2025-08-28 16:21:27 +02:00
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
fde6e73189