No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Duoming Zhou a6f68f219d scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]

During the detaching of Marvell's SAS/SATA controller, the original code
calls cancel_delayed_work() in mvs_free() to cancel the delayed work
item mwq->work_q. However, if mwq->work_q is already running, the
cancel_delayed_work() may fail to cancel it. This can lead to
use-after-free scenarios where mvs_free() frees the mvs_info while
mvs_work_queue() is still executing and attempts to access the
already-freed mvs_info.

A typical race condition is illustrated below:

CPU 0 (remove)            | CPU 1 (delayed work callback)
mvs_pci_remove()          |
  mvs_free()              | mvs_work_queue()
    cancel_delayed_work() |
      kfree(mvi)          |
                          |   mvi-> // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the delayed work item is properly canceled and any executing
delayed work item completes before the mvs_info is deallocated.

This bug was found by static analysis.

Fixes: 20b09c2992 ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-10-29 13:59:51 +01:00
arch sparc: fix accurate exception reporting in copy_{from,to}_user for M7 2025-10-29 13:59:49 +01:00
block
certs
crypto
Documentation
drivers scsi: mvsas: Fix use-after-free bugs in mvs_work_queue 2025-10-29 13:59:51 +01:00
fs Squashfs: fix uninit-value in squashfs_get_parent 2025-10-29 13:59:50 +01:00
include scsi: libsas: Add sas_task_find_rq() 2025-10-29 13:59:51 +01:00
init
ipc
kernel
lib
LICENSES
mm mm: hugetlb: avoid soft lockup when mprotect to large memory area 2025-10-29 13:59:50 +01:00
net ipvs: Defer ip_vs_ftp unregister during netns cleanup 2025-10-29 13:59:49 +01:00
samples
scripts
security
sound ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping 2025-10-29 13:59:48 +01:00
tools perf session: Fix handling when buffer exceeds 2 GiB 2025-10-29 13:59:50 +01:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.