Zheyu Ma
eb8f087201
memstick: r592: Fix a UAF bug when removing the driver
[ Upstream commit 738216c1953e802aa9f930c5d15b8f9092c847ff ]
In r592_remove(), the driver will free dma after freeing the host, which
may cause a UAF bug.
The following log reveals it:
[ 45.361796 ] BUG: KASAN: use-after-free in r592_remove+0x269/0x350 [r592]
[ 45.364286 ] Call Trace:
[ 45.364472 ] dump_stack_lvl+0xa8/0xd1
[ 45.364751 ] print_address_description+0x87/0x3b0
[ 45.365137 ] kasan_report+0x172/0x1c0
[ 45.365415 ] ? r592_remove+0x269/0x350 [r592]
[ 45.365834 ] ? r592_remove+0x269/0x350 [r592]
[ 45.366168 ] __asan_report_load8_noabort+0x14/0x20
[ 45.366531 ] r592_remove+0x269/0x350 [r592]
[ 45.378785 ]
[ 45.378903 ] Allocated by task 4674:
[ 45.379162 ] ____kasan_kmalloc+0xb5/0xe0
[ 45.379455 ] __kasan_kmalloc+0x9/0x10
[ 45.379730 ] __kmalloc+0x150/0x280
[ 45.379984 ] memstick_alloc_host+0x2a/0x190
[ 45.380664 ]
[ 45.380781 ] Freed by task 5509:
[ 45.381014 ] kasan_set_track+0x3d/0x70
[ 45.381293 ] kasan_set_free_info+0x23/0x40
[ 45.381635 ] ____kasan_slab_free+0x10b/0x140
[ 45.381950 ] __kasan_slab_free+0x11/0x20
[ 45.382241 ] slab_free_freelist_hook+0x81/0x150
[ 45.382575 ] kfree+0x13e/0x290
[ 45.382805 ] memstick_free+0x1c/0x20
[ 45.383070 ] device_release+0x9c/0x1d0
[ 45.383349 ] kobject_put+0x2ef/0x4c0
[ 45.383616 ] put_device+0x1f/0x30
[ 45.383865 ] memstick_free_host+0x24/0x30
[ 45.384162 ] r592_remove+0x242/0x350 [r592]
[ 45.384473 ] pci_device_remove+0xa9/0x250
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1634383581-11055-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
2021-11-17 09:48:31 +01:00 |
| .. |
|
accessibility
|
|
|
|
acpi
|
ACPI: battery: Accept charges over the design capacity as full
|
2021-11-17 09:48:30 +01:00 |
|
amba
|
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
|
2021-11-06 13:59:45 +01:00 |
|
android
|
binder: use cred instead of task for getsecid
|
2021-11-17 09:48:16 +01:00 |
|
ata
|
libata: fix checking of DMA state
|
2021-11-17 09:48:23 +01:00 |
|
atm
|
atm: nicstar: register the interrupt handler in the right place
|
2021-07-19 08:53:12 +02:00 |
|
auxdisplay
|
|
|
|
base
|
regmap: Fix possible double-free in regcache_rbtree_exit()
|
2021-11-02 19:46:13 +01:00 |
|
bcma
|
bcma: Fix memory leak for internally-handled cores
|
2021-09-15 09:47:37 +02:00 |
|
block
|
Revert "block: nbd: add sanity check for first_minor"
|
2021-09-16 12:56:13 +02:00 |
|
bluetooth
|
Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
|
2021-07-19 08:53:13 +02:00 |
|
bus
|
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
|
2021-10-13 10:08:19 +02:00 |
|
cdrom
|
cdrom: gdrom: initialize global variable at init time
|
2021-05-26 12:05:19 +02:00 |
|
char
|
ipmi: Disable some operations during a panic
|
2021-11-17 09:48:30 +01:00 |
|
clk
|
clk: at91: clk-generated: Limit the requested rate to our range
|
2021-09-22 12:26:25 +02:00 |
|
clocksource
|
clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
|
2021-09-15 09:47:29 +02:00 |
|
connector
|
|
|
|
counter
|
counter: 104-quad-8: Return error when invalid mode during ceiling_write
|
2021-09-15 09:47:34 +02:00 |
|
cpufreq
|
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
|
2021-10-06 15:42:30 +02:00 |
|
cpuidle
|
|
|
|
crypto
|
crypto: s5p-sss - Add error handling in s5p_aes_probe()
|
2021-11-17 09:48:17 +01:00 |
|
dax
|
|
|
|
dca
|
|
|
|
devfreq
|
PM / devfreq: Use more accurate returned new_freq as resume_freq
|
2021-05-14 09:44:20 +02:00 |
|
dio
|
|
|
|
dma
|
dmaengine: xilinx_dma: Set DMA mask for coherent APIs
|
2021-09-26 14:07:11 +02:00 |
|
dma-buf
|
dma-buf: WARN on dmabuf release with pending attachments
|
2021-11-17 09:48:27 +01:00 |
|
edac
|
EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
|
2021-11-17 09:48:22 +01:00 |
|
eisa
|
|
|
|
extcon
|
extcon: intel-mrfld: Sync hardware and software state on init
|
2021-07-19 08:53:16 +02:00 |
|
firewire
|
|
|
|
firmware
|
firmware/psci: fix application of sizeof to pointer
|
2021-11-17 09:48:17 +01:00 |
|
fpga
|
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
|
2021-09-30 10:09:23 +02:00 |
|
fsi
|
fsi/sbefifo: Fix reset timeout
|
2021-07-14 16:53:42 +02:00 |
|
gnss
|
|
|
|
gpio
|
gpio: pca953x: Improve bias setting
|
2021-10-20 11:40:15 +02:00 |
|
gpu
|
drm/panel-orientation-quirks: add Valve Steam Deck
|
2021-11-17 09:48:27 +01:00 |
|
greybus
|
|
|
|
hid
|
HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
|
2021-10-17 10:42:33 +02:00 |
|
hsi
|
HSI: core: fix resource leaks in hsi_add_client_from_dt()
|
2021-05-14 09:44:25 +02:00 |
|
hv
|
hyperv/vmbus: include linux/bitops.h
|
2021-11-17 09:48:20 +01:00 |
|
hwmon
|
hwmon: (pmbus/lm25066) Add offset coefficients
|
2021-11-17 09:48:22 +01:00 |
|
hwspinlock
|
|
|
|
hwtracing
|
intel_th: Wait until port is in reset before programming it
|
2021-07-20 16:10:46 +02:00 |
|
i2c
|
i2c: acpi: fix resource leak in reconfiguration device addition
|
2021-10-13 10:08:20 +02:00 |
|
i3c
|
Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
|
2021-05-14 09:44:15 +02:00 |
|
ide
|
|
|
|
idle
|
|
|
|
iio
|
iio: dac: ad5446: Fix ad5622_write() return value
|
2021-11-17 09:48:26 +01:00 |
|
infiniband
|
RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
|
2021-11-17 09:48:24 +01:00 |
|
input
|
Input: i8042 - Add quirk for Fujitsu Lifebook T725
|
2021-11-17 09:48:17 +01:00 |
|
interconnect
|
interconnect: core: fix error return code of icc_link_destroy()
|
2021-04-16 11:46:37 +02:00 |
|
iommu
|
iommu: Check if group is NULL before remove device
|
2021-08-26 08:36:15 -04:00 |
|
ipack
|
ipack: ipoctal: fix module reference leak
|
2021-10-06 15:42:36 +02:00 |
|
irqchip
|
irqchip/gic-v3-its: Fix potential VPE leak on error
|
2021-09-30 10:09:24 +02:00 |
|
isdn
|
isdn: mISDN: Fix sleeping function called from invalid context
|
2021-10-27 09:54:29 +02:00 |
|
leds
|
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
|
2021-09-15 09:47:33 +02:00 |
|
lightnvm
|
|
|
|
macintosh
|
|
|
|
mailbox
|
|
|
|
mcb
|
mcb: fix error handling in mcb_alloc_bus()
|
2021-09-30 10:09:22 +02:00 |
|
md
|
md: fix a lock order reversal in md_alloc
|
2021-09-30 10:09:24 +02:00 |
|
media
|
media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
|
2021-11-17 09:48:30 +01:00 |
|
memory
|
memory: fsl_ifc: fix leak of private memory on probe failure
|
2021-07-20 16:10:52 +02:00 |
|
memstick
|
memstick: r592: Fix a UAF bug when removing the driver
|
2021-11-17 09:48:31 +01:00 |
|
message
|
|
|
|
mfd
|
mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
|
2021-09-22 12:26:44 +02:00 |
|
misc
|
cb710: avoid NULL pointer subtraction
|
2021-10-20 11:40:13 +02:00 |
|
mmc
|
mmc: winbond: don't build on M68K
|
2021-11-17 09:48:20 +01:00 |
|
mtd
|
mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
|
2021-09-22 12:26:45 +02:00 |
|
mux
|
|
|
|
net
|
ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
|
2021-11-17 09:48:30 +01:00 |
|
nfc
|
nfc: port100: fix using -ERRNO as command type mask
|
2021-11-02 19:46:12 +01:00 |
|
ntb
|
NTB: perf: Fix an error code in perf_setup_inbuf()
|
2021-09-22 12:26:44 +02:00 |
|
nubus
|
|
|
|
nvdimm
|
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
|
2021-10-06 15:42:38 +02:00 |
|
nvme
|
nvmet-tcp: fix header digest verification
|
2021-11-17 09:48:21 +01:00 |
|
nvmem
|
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
|
2021-10-20 11:40:14 +02:00 |
|
of
|
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
|
2021-09-22 12:26:34 +02:00 |
|
opp
|
opp: Don't print an error if required-opps is missing
|
2021-09-22 12:26:33 +02:00 |
|
oprofile
|
|
|
|
parisc
|
parisc: Move pci_dev_is_behind_card_dino to where it is used
|
2021-09-26 14:07:10 +02:00 |
|
parport
|
parport: remove non-zero check on count
|
2021-09-22 12:26:36 +02:00 |
|
pci
|
PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
|
2021-11-17 09:48:26 +01:00 |
|
pcmcia
|
pcmcia: i82092: fix a null pointer dereference bug
|
2021-08-12 13:21:03 +02:00 |
|
perf
|
drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe()
|
2021-07-14 16:53:14 +02:00 |
|
phy
|
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
|
2021-07-14 16:53:46 +02:00 |
|
pinctrl
|
pinctrl: core: fix possible memory leak in pinctrl_enable()
|
2021-11-17 09:48:26 +01:00 |
|
platform
|
platform/x86: wmi: do not fail if disabling fails
|
2021-11-17 09:48:27 +01:00 |
|
pnp
|
|
|
|
power
|
power: supply: max17042_battery: use VFSOC for capacity when no rsns
|
2021-11-17 09:48:24 +01:00 |
|
powercap
|
|
|
|
pps
|
|
|
|
ps3
|
|
|
|
ptp
|
ptp_pch: Load module automatically if ID matches
|
2021-10-13 10:08:19 +02:00 |
|
pwm
|
pwm: stm32-lp: Don't modify HW state in .remove() callback
|
2021-09-26 14:07:13 +02:00 |
|
rapidio
|
rapidio: handle create_workqueue() failure
|
2021-05-26 12:05:17 +02:00 |
|
ras
|
RAS/CEC: Correct ce_add_elem()'s returned values
|
2021-04-14 08:24:18 +02:00 |
|
regulator
|
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
|
2021-11-17 09:48:22 +01:00 |
|
remoteproc
|
|
|
|
reset
|
reset: socfpga: add empty driver allowing consumers to probe
|
2021-11-17 09:48:20 +01:00 |
|
rpmsg
|
rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
|
2021-05-19 10:08:25 +02:00 |
|
rtc
|
rtc: rx8010: select REGMAP_I2C
|
2021-09-26 14:07:14 +02:00 |
|
s390
|
s390/sclp: fix Secure-IPL facility detection
|
2021-09-22 12:26:40 +02:00 |
|
sbus
|
|
|
|
scsi
|
scsi: qla2xxx: Fix unmap of already freed sgl
|
2021-11-17 09:48:20 +01:00 |
|
sfi
|
|
|
|
sh
|
|
|
|
siox
|
|
|
|
slimbus
|
slimbus: ngd: reset dma setup during runtime pm
|
2021-08-26 08:36:21 -04:00 |
|
soc
|
soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
|
2021-10-13 10:08:18 +02:00 |
|
soundwire
|
soundwire: stream: Fix test for DP prepare complete
|
2021-07-14 16:53:45 +02:00 |
|
spi
|
spi: spl022: fix Microwire full duplex mode
|
2021-11-17 09:48:21 +01:00 |
|
spmi
|
|
|
|
ssb
|
ssb: Fix error return code in ssb_bus_scan()
|
2021-07-14 16:53:29 +02:00 |
|
staging
|
media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
|
2021-11-17 09:48:30 +01:00 |
|
target
|
scsi: target: avoid per-loop XCOPY buffer allocations
|
2021-09-22 12:26:25 +02:00 |
|
tc
|
|
|
|
tee
|
tee: optee: Fix missing devices unregister during optee_remove
|
2021-10-27 09:54:25 +02:00 |
|
thermal
|
thermal/drivers/int340x: Do not set a wrong tcc offset on resume
|
2021-09-30 10:09:26 +02:00 |
|
thunderbolt
|
thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
|
2021-06-03 08:59:03 +02:00 |
|
tty
|
serial: core: Fix initializing and restoring termios speed
|
2021-11-17 09:48:25 +01:00 |
|
uio
|
uio_hv_generic: Fix a memory leak in error handling paths
|
2021-05-26 12:05:17 +02:00 |
|
usb
|
USB: chipidea: fix interrupt deadlock
|
2021-11-17 09:48:27 +01:00 |
|
vfio
|
vfio: Use config not menuconfig for VFIO_NOIOMMU
|
2021-09-22 12:26:23 +02:00 |
|
vhost
|
vhost_net: fix OoB on sendmsg() failure.
|
2021-09-22 12:26:41 +02:00 |
|
video
|
video: fbdev: gbefb: Only instantiate device when built for IP32
|
2021-10-13 10:08:19 +02:00 |
|
virt
|
|
|
|
virtio
|
virtio: write back F_VERSION_1 before validate
|
2021-10-20 11:40:14 +02:00 |
|
visorbus
|
visorbus: fix error return code in visorchipset_init()
|
2021-07-14 16:53:42 +02:00 |
|
vlynq
|
|
|
|
vme
|
|
|
|
w1
|
w1: ds2438: fixing bug that would always get page0
|
2021-07-20 16:10:41 +02:00 |
|
watchdog
|
watchdog: Fix OMAP watchdog early handling
|
2021-11-17 09:48:21 +01:00 |
|
xen
|
xen/balloon: add late_initcall_sync() for initial ballooning done
|
2021-11-17 09:48:25 +01:00 |
|
zorro
|
|
|
|
Kconfig
|
|
|
|
Makefile
|
|
|