No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Tuomas Tynkkynen ab9ee18f46 usbnet: smsc95xx: Fix use-after-free after removal
[ Upstream commit b835a71ef64a61383c414d6bf2896d2c0161deca ]

Syzbot reports an use-after-free in workqueue context:

BUG: KASAN: use-after-free in mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737
 mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737
 __smsc95xx_mdio_read drivers/net/usb/smsc95xx.c:217 [inline]
 smsc95xx_mdio_read+0x583/0x870 drivers/net/usb/smsc95xx.c:278
 check_carrier+0xd1/0x2e0 drivers/net/usb/smsc95xx.c:644
 process_one_work+0x777/0xf90 kernel/workqueue.c:2274
 worker_thread+0xa8f/0x1430 kernel/workqueue.c:2420
 kthread+0x2df/0x300 kernel/kthread.c:255

It looks like that smsc95xx_unbind() is freeing the structures that are
still in use by the concurrently running workqueue callback. Thus switch
to using cancel_delayed_work_sync() to ensure the work callback really
is no longer active.

Reported-by: syzbot+29dc7d4ae19b703ff947@syzkaller.appspotmail.com
Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-09 09:37:49 +02:00
arch arm64: dts: imx8mn-ddr4-evk: correct ldo1/ldo2 voltage range 2020-06-30 15:37:10 -04:00
block block: update hctx map when use multiple maps 2020-06-30 15:37:06 -04:00
certs
crypto crypto: algboss - don't wait during notifier callback 2020-06-24 17:50:51 +02:00
Documentation dt-bindings: display: mediatek: control dpi pins mode to avoid leakage 2020-06-22 09:30:58 +02:00
drivers usbnet: smsc95xx: Fix use-after-free after removal 2020-07-09 09:37:49 +02:00
fs io_uring: make sure async workqueue is canceled on exit 2020-07-09 09:37:49 +02:00
include net: qed: fix left elements count calculation 2020-06-30 15:36:58 -04:00
init x86: Fix early boot crash on gcc-10, third try 2020-05-20 08:20:34 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel ring-buffer: Zero out time extend if it is nested and not absolute 2020-06-30 15:37:10 -04:00
lib test_objagg: Fix potential memory leak in error handling 2020-06-30 15:37:04 -04:00
LICENSES
mm mm: fix swap cache node allocation mask 2020-07-09 09:37:49 +02:00
net xprtrdma: Fix handling of RDMA_ERROR replies 2020-06-30 15:37:12 -04:00
samples bpf, xdp, samples: Fix null pointer dereference in *_user code 2020-06-30 15:36:55 -04:00
scripts recordmcount: support >64k sections 2020-06-30 15:37:05 -04:00
security selinux: fix double free 2020-06-24 17:50:48 +02:00
sound ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems 2020-06-30 15:37:06 -04:00
tools selftests/net: report etf errors correctly 2020-06-30 15:36:58 -04:00
usr
virt KVM: arm64: Save the host's PtrAuth keys in non-preemptible context 2020-06-17 16:40:38 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.50 2020-06-30 16:21:55 -04:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.