Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Kaixin Wang b5a84b6c77 net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition ... [ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ] In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ether3_ledoff ether3_remove | free_netdev(dev); | put_devic | kfree(dev); | | ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2); | // use dev Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove. Fixes: 6fd9c53f71 ("net: seeq: Convert timers to use timer_setup()") Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn> Link: https://patch.msgid.link/20240915144045.451-1-kxwang23@m.fudan.edu.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-08 16:20:33 +01:00
..
accessibility
acpi	ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()	2024-11-08 16:20:26 +01:00
amba
android	binder: fix UAF caused by offsets overwrite	2024-09-12 11:03:55 +02:00
ata	ata: pata_macio: Use WARN instead of BUG	2024-09-12 11:03:55 +02:00
atm	atm: idt77252: prevent use after free in dequeue_rx()	2024-09-04 13:14:51 +02:00
auxdisplay
base	devres: Initialize an uninitialized struct member	2024-09-12 11:03:54 +02:00
bcma
block	rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings	2024-08-19 05:33:40 +02:00
bluetooth	Bluetooth: btusb: Fix not handling ZPL/short-transfer	2024-11-08 16:20:27 +01:00
bus	bus: tegra-aconnect: Update dependency to ARCH_TEGRA	2024-03-26 18:22:15 -04:00
cdrom
char	tpm: Clean up TPM space after command failure	2024-11-08 16:20:30 +01:00
clk	clk: ti: dra7-atl: Fix leak of of_nodes	2024-11-08 16:20:31 +01:00
clocksource	clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()	2024-11-08 16:20:28 +01:00
connector
counter
cpufreq	cpufreq: exit() callback is optional	2024-06-16 13:28:34 +02:00
cpuidle
crypto	crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak	2024-06-16 13:28:51 +02:00
dax
dca
devfreq
dio
dma	dmaengine: ioatdma: Fix missing kmem_cache_destroy()	2024-07-05 09:08:23 +02:00
dma-buf	dma-buf/sw-sync: don't enable IRQ from sync_print_obj()	2024-06-16 13:28:47 +02:00
edac	EDAC, i10nm: make skx_common.o a separate module	2024-08-19 05:33:25 +02:00
eisa
extcon	extcon: max8997: select IRQ_DOMAIN instead of depending on it	2024-06-16 13:28:43 +02:00
firewire	firewire: nosy: ensure user_length is taken into account when fetching packet contents	2024-05-17 11:43:54 +02:00
firmware	firmware: turris-mox-rwtm: Initialize completion before mailbox	2024-08-19 05:33:28 +02:00
fpga
fsi
gnss
gpio	gpio: prevent potential speculation leaks in gpio_device_get_desc()	2024-11-08 16:20:26 +01:00
gpu	drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()	2024-11-08 16:20:29 +01:00
greybus	greybus: Fix use-after-free bug in gb_interface_release due to race condition.	2024-07-05 09:08:20 +02:00
hid	HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup	2024-09-12 11:03:54 +02:00
hsi
hv	Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic	2024-09-12 11:03:55 +02:00
hwmon	hwmon: (ntc_thermistor) fix module autoloading	2024-11-08 16:20:28 +01:00
hwspinlock
hwtracing	coresight: tmc: sg: Do not leak sg_table	2024-11-08 16:20:32 +01:00
i2c	i2c: riic: avoid potential division by zero	2024-09-04 13:14:53 +02:00
i3c	i3c: master: cdns: Update maximum prescaler value for i2c clock	2024-02-23 08:25:02 +01:00
ide
idle
iio	iio: adc: ad7606: fix standby gpio state to match the documentation	2024-11-08 16:20:32 +01:00
infiniband	RDMA/cxgb4: Added NULL check for lookup_atid	2024-11-08 16:20:32 +01:00
input	Input: uinput - reject requests with unreasonable number of slots	2024-09-12 11:03:55 +02:00
interconnect
iommu	iommu/vt-d: Handle volatile descriptor status read	2024-09-12 11:03:53 +02:00
ipack
irqchip	irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1	2024-09-12 11:03:52 +02:00
isdn	mISDN: Fix a use after free in hfcmulti_tx()	2024-08-19 05:33:42 +02:00
leds	leds: ss4200: Convert PCIBIOS_* return codes to errnos	2024-08-19 05:33:37 +02:00
lightnvm
macintosh	macintosh/therm_windtunnel: fix module unload.	2024-08-19 05:33:34 +02:00
mailbox
mcb
md	dm init: Handle minors larger than 255	2024-09-12 11:03:53 +02:00
media	drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error	2024-11-08 16:20:31 +01:00
memory
memstick
message
mfd	mfd: omap-usb-tll: Use struct_size to allocate tll	2024-08-19 05:33:32 +02:00
misc	VMCI: Fix use-after-free when removing resource in vmci_resource_remove()	2024-09-12 11:03:55 +02:00
mmc	mmc: sdhci-of-aspeed: fix module autoloading	2024-09-12 11:03:51 +02:00
mtd	mtd: powernv: Add check devm_kasprintf() returned value	2024-11-08 16:20:28 +01:00
mux
net	net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition	2024-11-08 16:20:33 +01:00
nfc	nfc: pn533: Add poll mod list filling check	2024-09-04 13:15:04 +02:00
ntb	ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()	2024-11-08 16:20:32 +01:00
nubus
nvdimm
nvme	nvmet-tcp: fix kernel crash if commands allocation fails	2024-09-12 11:03:56 +02:00
nvmem	nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc	2024-09-12 11:03:55 +02:00
of	of/irq: Prevent device address out-of-bounds read in interrupt map walk	2024-09-12 11:03:55 +02:00
opp
oprofile
parisc
parport	dev/parport: fix the array out-of-bounds risk	2024-08-19 05:33:43 +02:00
pci	PCI: xilinx-nwl: Fix register misspelling	2024-11-08 16:20:31 +01:00
pcmcia	pcmcia: Use resource_size function on resource object	2024-09-12 11:03:52 +02:00
perf
phy	phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP	2024-02-23 08:25:06 +01:00
pinctrl	pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function	2024-11-08 16:20:32 +01:00
platform	platform/x86: dell-smbios: Fix error path in dell_smbios_init()	2024-09-12 11:03:52 +02:00
pnp	PNP: ACPI: fix fortify warning	2024-02-23 08:24:54 +01:00
power	power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense	2024-11-08 16:20:28 +01:00
powercap
pps
ps3
ptp	ptp: Fix error message on failed pin verification	2024-07-05 09:08:11 +02:00
pwm	pwm: stm32: Always do lazy disabling	2024-08-19 05:33:26 +02:00
rapidio
ras
regulator	regulator: core: Fix modpost error "regulator_get_regmap" undefined	2024-07-05 09:08:23 +02:00
remoteproc	remoteproc: imx_rproc: Skip over memory region when node value is NULL	2024-08-19 05:33:44 +02:00
reset	reset: berlin: fix OF node leak in probe() error path	2024-11-08 16:20:28 +01:00
rpmsg
rtc	rtc: isl1208: Fix return value of nvmem callbacks	2024-08-19 05:33:39 +02:00
s390	s390/cio: rename bitmap_size() -> idset_bitmap_size()	2024-09-04 13:14:51 +02:00
sbus
scsi	scsi: aacraid: Fix double-free on probe failure	2024-09-04 13:15:05 +02:00
sfi
sh
siox
slimbus	slimbus: core: Remove usage of the deprecated ida_simple_xx() API	2024-04-13 12:51:26 +02:00
soc	soc: qcom: cmd-db: Map shared memory as WC, not WB	2024-09-04 13:15:04 +02:00
soundwire	soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"	2024-11-08 16:20:25 +01:00
spi	spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ	2024-11-08 16:20:28 +01:00
spmi
ssb	ssb: Fix division by zero issue in ssb_calc_clock_rate	2024-09-04 13:14:53 +02:00
staging	wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param	2024-11-08 16:20:27 +01:00
target	scsi: target: Fix SELinux error when systemd-modules loads the target module	2024-05-17 11:43:51 +02:00
tc
tee
thermal
thunderbolt
tty	serial: core: check uartclk for zero to avoid divide by zero	2024-08-19 05:33:52 +02:00
uio	Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic	2024-09-12 11:03:55 +02:00
usb	USB: usbtmc: prevent kernel-usb-infoleak	2024-11-08 16:20:26 +01:00
vfio	vfio/platform: Create persistent IRQ handlers	2024-04-13 12:51:34 +02:00
vhost	vhost: Add smp_rmb() in vhost_vq_avail_empty()	2024-05-02 16:18:29 +02:00
video	fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()	2024-11-08 16:20:28 +01:00
virt
virtio	virtio: delete vq in vp_find_vqs_msix() when request_irq() fails	2024-06-16 13:28:46 +02:00
visorbus
vlynq
vme
w1
watchdog	watchdog: imx_sc_wdt: Don't disable WDT in suspend	2024-11-08 16:20:32 +01:00
xen	xen/swiotlb: add alignment check for dma buffers	2024-11-08 16:20:30 +01:00
zorro
Kconfig
Makefile