iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Tuomas Tynkkynen b835a71ef6 usbnet: smsc95xx: Fix use-after-free after removal 
Syzbot reports an use-after-free in workqueue context:

BUG: KASAN: use-after-free in mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737
 mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737
 __smsc95xx_mdio_read drivers/net/usb/smsc95xx.c:217 [inline]
 smsc95xx_mdio_read+0x583/0x870 drivers/net/usb/smsc95xx.c:278
 check_carrier+0xd1/0x2e0 drivers/net/usb/smsc95xx.c:644
 process_one_work+0x777/0xf90 kernel/workqueue.c:2274
 worker_thread+0xa8f/0x1430 kernel/workqueue.c:2420
 kthread+0x2df/0x300 kernel/kthread.c:255

It looks like that smsc95xx_unbind() is freeing the structures that are
still in use by the concurrently running workqueue callback. Thus switch
to using cancel_delayed_work_sync() to ensure the work callback really
is no longer active.

Reported-by: syzbot+29dc7d4ae19b703ff947@syzkaller.appspotmail.com
Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-22 16:34:31 -07:00
..
accessibility
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
acpi
libnvdimm for 5.8
2020-06-13 13:04:36 -07:00
amba
ARM: tegra: Replace zero-length array with flexible-array
2020-06-15 23:08:28 -05:00
android
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ata
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
atm
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
auxdisplay
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
base
linux-kselftest-kunit-5.8-rc1
2020-06-09 10:04:47 -07:00
bcma
…
block
drbd: Replace zero-length array with flexible-array
2020-06-15 23:08:31 -05:00
bluetooth
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2020-06-03 16:27:18 -07:00
bus
Char/Misc driver patches for 5.8-rc1
2020-06-07 10:59:32 -07:00
cdrom
Merge branch 'work.sysctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-06-10 16:05:54 -07:00
char
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
clk
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
clocksource
clocksource/drivers/timer-riscv: Use per-CPU timer interrupt
2020-06-09 19:11:22 -07:00
connector
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
counter
…
cpufreq
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
cpuidle
- Add the hwmon support on the i.MX SC (Anson Huang)
2020-06-12 14:10:21 -07:00
crypto
crypto: Replace zero-length array with flexible-array
2020-06-15 23:08:31 -05:00
dax
device-dax: add memory via add_memory_driver_managed()
2020-06-04 19:06:23 -07:00
dca
…
devfreq
…
dio
…
dma
dmaengine: tegra-apb: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
dma-buf
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
edac
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
eisa
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
extcon
…
firewire
firewire: ohci: Replace zero-length array with flexible-array
2020-06-15 23:08:31 -05:00
firmware
firmware: pcdp: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
fpga
Char/Misc driver patches for 5.8-rc1
2020-06-07 10:59:32 -07:00
fsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gnss
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gpio
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gpu
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
greybus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hid
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hv
hyperv-next for 5.8
2020-06-03 15:00:05 -07:00
hwmon
Merge branch 'x86/entry' into ras/core
2020-06-11 15:17:57 +02:00
hwspinlock
…
hwtracing
stm class: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
i2c
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
i3c
…
ide
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
idle
…
iio
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
infiniband
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
input
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
interconnect
More power management updates for 5.8-rc1
2020-06-10 14:04:39 -07:00
iommu
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
ipack
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
irqchip
clocksource/drivers/timer-riscv: Use per-CPU timer interrupt
2020-06-09 19:11:22 -07:00
isdn
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
leds
LEDs pull request for 5.8-rc1.
2020-06-04 11:03:45 -07:00
lightnvm
for-5.8/block-2020-06-01
2020-06-02 15:29:19 -07:00
macintosh
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
mailbox
mailbox: qcom: Add ipq6018 apcs compatible
2020-06-10 22:43:57 -05:00
mcb
…
md
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
media
media: pwc: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
memory
…
memstick
…
message
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
mfd
mfd: mt6360: Fix register driver NULL pointer by adding driver name
2020-06-16 09:32:43 +01:00
misc
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
mmc
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
most
…
mtd
This pull request contains a single change for UBI:
2020-06-10 13:24:40 -07:00
mux
…
net
usbnet: smsc95xx: Fix use-after-free after removal
2020-06-22 16:34:31 -07:00
nfc
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ntb
NTB: perf: Fix race condition when run with ntb_test
2020-06-05 20:02:09 -04:00
nubus
…
nvdimm
libnvdimm for 5.8
2020-06-13 13:04:36 -07:00
nvme
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
nvmem
…
of
of: of_mdio: Correct loop scanning logic
2020-06-19 13:39:00 -07:00
opp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
oprofile
oprofile: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
parisc
…
parport
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pci
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
pcmcia
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
perf
arm64 merge window fixes for -rc1
2020-06-11 12:53:23 -07:00
phy
phy: samsung: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
pinctrl
This is the bulk of pin control changes for the v5.8
2020-06-07 16:13:43 -07:00
platform
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
pnp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
power
power supply and reset changes for the v5.8 series
2020-06-10 11:28:35 -07:00
powercap
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
pps
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ps3
…
ptp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pwm
pwm: Add missing "CONFIG_" prefix
2020-06-04 19:09:28 +02:00
rapidio
rapidio: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
ras
…
regulator
Merge remote-tracking branch 'regulator/for-5.8' into regulator-linus
2020-06-01 13:01:44 +01:00
remoteproc
remoteproc updates for v5.8
2020-06-08 13:01:08 -07:00
reset
Char/Misc driver patches for 5.8-rc1
2020-06-07 10:59:32 -07:00
rpmsg
remoteproc updates for v5.8
2020-06-08 13:01:08 -07:00
rtc
RTC for 5.8
2020-06-07 16:11:23 -07:00
s390
s390/qeth: let isolation mode override HW offload restrictions
2020-06-18 20:27:42 -07:00
sbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
scsi
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
sfi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
sh
…
siox
…
slimbus
…
soc
soc: ti: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
soundwire
…
spi
Char/Misc driver patches for 5.8-rc1
2020-06-07 10:59:32 -07:00
spmi
…
ssb
…
staging
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
target
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
tc
…
tee
mmap locking API: use coccinelle to convert mmap_sem rwsem call sites
2020-06-09 09:39:14 -07:00
thermal
- Add the hwmon support on the i.MX SC (Anson Huang)
2020-06-12 14:10:21 -07:00
thunderbolt
USB/PHY driver updates for 5.8-rc1
2020-06-07 09:42:16 -07:00
tty
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
uio
…
usb
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
vdpa
ifcvf: implement config interrupt in IFCVF
2020-06-06 16:26:47 -04:00
vfio
kernel: better document the use_mm/unuse_mm API contract
2020-06-10 19:14:18 -07:00
vhost
Kbuild updates for v5.8 (2nd)
2020-06-13 13:29:16 -07:00
video
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
virt
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
virtio
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
visorbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
vlynq
…
vme
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
w1
w1: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
watchdog
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
xen
The X86 entry, exception and interrupt code rework
2020-06-13 10:05:47 -07:00
zorro
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
Kconfig
…
Makefile
…