iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f723d7ea08e2c69ac9ecd87828c650745270fb98
linux/drivers
History
Johan Hovold f723d7ea08 USB: iowarrior: fix use-after-free on disconnect 
commit edc4746f25 upstream.

A recent fix addressing a deadlock on disconnect introduced a new bug
by moving the present flag out of the critical section protected by the
driver-data mutex. This could lead to a racing release() freeing the
driver data before disconnect() is done with it.

Due to insufficient locking a related use-after-free could be triggered
also before the above mentioned commit. Specifically, the driver needs
to hold the driver-data mutex also while checking the opened flag at
disconnect().

Fixes: c468a8aa79 ("usb: iowarrior: fix deadlock on disconnect")
Fixes: 946b960d13 ("USB: add driver for iowarrior devices.")
Cc: stable <stable@vger.kernel.org>	# 2.6.21
Reported-by: syzbot+0761012cebf7bdb38137@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009104846.5925-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-17 13:40:59 -07:00
..
accessibility
…
acpi
ACPI: custom_method: fix memory leaks
2019-10-05 12:27:49 +02:00
amba
ARM: amba: Don't read past the end of sysfs "driver_override" buffer
2018-05-02 07:53:42 -07:00
android
ANDROID: binder: synchronize_rcu() when using POLLFREE.
2019-10-07 21:01:03 +02:00
ata
libata: add SG safety checks in SFF pio transfers
2019-09-06 10:18:08 +02:00
atm
Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
2019-09-21 07:12:50 +02:00
auxdisplay
…
base
base: soc: Export soc_device_register/unregister APIs
2019-10-05 12:27:46 +02:00
bcma
…
block
floppy: fix usercopy direction
2019-09-21 07:12:53 +02:00
bluetooth
Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
2019-10-05 12:27:40 +02:00
bus
bus: brcmstb_gisb: correct support for 64-bit address output
2018-04-13 19:50:05 +02:00
cdrom
cdrom: Fix race condition in cdrom_sysctl_register
2019-04-27 09:33:52 +02:00
char
ipmi_si: Only schedule continuously in the thread in maintenance mode
2019-10-07 21:00:59 +02:00
clk
clk: sirf: Don't reference clk_init_data after registration
2019-10-07 21:01:00 +02:00
clocksource
clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
2019-03-23 08:44:35 +01:00
connector
…
cpufreq
cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
2019-08-25 10:52:47 +02:00
cpuidle
cpuidle: big.LITTLE: fix refcount leak
2019-02-20 10:13:09 +01:00
crypto
crypto: caam - fix concurrency issue in givencrypt descriptor
2019-10-17 13:40:56 -07:00
dca
…
devfreq
PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()
2018-11-10 07:41:40 -08:00
dio
…
dma
dmaengine: ti: edma: Do not reset reserved paRAM slots
2019-10-05 12:27:50 +02:00
dma-buf
…
edac
EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
2019-08-04 09:34:48 +02:00
eisa
…
extcon
extcon: arizona: Disable mic detect if running when driver is removed
2019-06-11 12:24:01 +02:00
firewire
firewire-ohci: work around oversized DMA reads on JMicron controllers
2018-05-30 07:48:52 +02:00
firmware
efi: cper: print AER info of PCIe fatal error
2019-10-05 12:27:47 +02:00
fmc
…
fpga
…
gpio
gpio: omap: ensure irq is enabled before wakeup
2019-08-04 09:34:45 +02:00
gpu
drm/amdgpu: Check for valid number of registers to read
2019-10-17 13:40:55 -07:00
hid
HID: apple: Fix stuck function keys when using FN
2019-10-07 21:01:02 +02:00
hsi
…
hv
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
2019-01-13 10:05:27 +01:00
hwmon
hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap'
2019-10-05 12:27:49 +02:00
hwspinlock
…
hwtracing
stm class: Fix a double free of stm_source_device
2019-09-06 10:18:17 +02:00
i2c
i2c: riic: Clear NACK in tend isr
2019-10-05 12:27:55 +02:00
ide
ide: pmac: add of_node_put()
2018-12-21 14:09:52 +01:00
idle
…
iio
iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
2019-06-11 12:24:02 +02:00
infiniband
IB/mlx4: Fix memory leaks
2019-09-10 10:29:48 +01:00
input
Input: psmouse - fix build error of multiple definition
2019-08-25 10:53:03 +02:00
iommu
iommu/amd: Move iommu_init_pci() to .init section
2019-08-25 10:53:05 +02:00
ipack
…
irqchip
irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
2019-10-05 12:27:39 +02:00
isdn
mISDN: enforce CAP_NET_RAW for raw sockets
2019-10-05 12:27:42 +02:00
leds
leds: leds-lp5562 allow firmware files up to the maximum length
2019-10-05 12:27:44 +02:00
lguest
…
lightnvm
…
macintosh
macintosh/via-pmu: Add missing mmio accessors
2018-09-19 22:48:57 +02:00
mailbox
mailbox: handle failed named mailbox channel request
2019-08-04 09:34:58 +02:00
mcb
…
md
md/raid6: Set R5_ReadError when there is read failure on parity disk
2019-10-05 12:27:54 +02:00
media
media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table
2019-10-05 12:27:53 +02:00
memory
memory: tegra: Fix integer overflow on tick value calculation
2019-06-11 12:23:46 +02:00
memstick
memstick: Fix error cleanup path of memstick_init
2019-08-04 09:34:56 +02:00
message
scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-05-30 07:48:58 +02:00
mfd
mfd: intel-lpss: Remove D3cold delay
2019-10-07 21:01:01 +02:00
misc
VMCI: Release resource if the work is already queued
2019-09-06 10:18:17 +02:00
mmc
mmc: sdhci: Fix incorrect switch to HS mode
2019-10-05 12:27:50 +02:00
mtd
mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
2019-10-05 12:27:37 +02:00
net
ieee802154: atusb: fix use-after-free at disconnect
2019-10-17 13:40:54 -07:00
nfc
st_nci_hci_connectivity_event_received: null check the allocation
2019-09-06 10:18:05 +02:00
ntb
ntb_transport: Fix bug with max_mw_size parameter
2018-05-30 07:48:55 +02:00
nubus
…
nvdimm
libnvdimm/btt: Fix a kmemdup failure check
2019-05-16 19:45:05 +02:00
nvme
nvme-pci: initialize queue memory before interrupts
2018-07-11 16:03:47 +02:00
nvmem
nvmem: core: fix read buffer in place
2019-06-22 08:18:20 +02:00
of
of: add helper to lookup compatible child node
2018-12-01 09:46:35 +01:00
oprofile
…
parisc
parisc: Disable HP HSC-PCI Cards to prevent kernel crash
2019-10-05 12:27:52 +02:00
parport
parport: Fix mem leak in parport_register_dev_model
2019-07-10 09:56:31 +02:00
pci
PCI: sysfs: Ignore lockdep for remove attribute
2019-08-04 09:34:57 +02:00
pcmcia
pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
2018-11-21 09:27:30 +01:00
perf
…
phy
phy: renesas: rcar-gen2: Fix memory leak at error paths
2019-08-04 09:34:57 +02:00
pinctrl
pinctrl: tegra: Fix write barrier placement in pmx_writel
2019-10-07 21:01:00 +02:00
platform
platform/chrome: cros_ec_proto: check for NULL transfer function
2019-06-22 08:18:20 +02:00
pnp
…
power
power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
2019-06-11 12:23:49 +02:00
powercap
PowerCap: Fix an error code in powercap_register_zone()
2018-04-13 19:50:05 +02:00
pps
drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
2019-08-04 09:35:02 +02:00
ps3
…
ptp
ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
2019-02-20 10:13:05 +01:00
pwm
pwm: Fix deadlock warning when removing PWM device
2019-06-22 08:18:21 +02:00
rapidio
…
ras
…
regulator
regulator: s2mps11: Fix buck7 and buck8 wrong voltages
2019-08-04 09:34:50 +02:00
remoteproc
…
reset
…
rpmsg
…
rtc
rtc: 88pm860x: prevent use-after-free on device remove
2019-06-11 12:23:54 +02:00
s390
s390/cio: exclude subchannels with no parent from pseudo check
2019-10-17 13:40:53 -07:00
sbus
drivers/sbus/char: add of_node_put()
2018-12-21 14:09:52 +01:00
scsi
scsi: core: Reduce memory required for SCSI logging
2019-10-07 21:01:01 +02:00
sfi
…
sh
…
sn
…
soc
soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
2019-06-22 08:18:20 +02:00
spi
spi: bcm2835aux: fix corruptions for longer spi transfers
2019-09-10 10:29:50 +01:00
spmi
…
ssb
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
2019-06-11 12:23:53 +02:00
staging
staging: comedi: dt3000: Fix rounding up of timer divisor
2019-08-25 10:53:01 +02:00
target
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
2019-03-23 08:44:35 +01:00
tc
TC: Set DMA masks for devices
2018-11-21 09:27:36 +01:00
thermal
thermal: Fix use-after-free when unregistering thermal zone device
2019-10-17 13:40:55 -07:00
thunderbolt
thunderbolt: Resume control channel after hibernation image is created
2018-04-24 09:32:07 +02:00
tty
tty/serial: atmel: reschedule TX after RX was started
2019-09-21 07:12:48 +02:00
uio
uio: Fix an Oops on load
2018-11-27 16:08:02 +01:00
usb
USB: iowarrior: fix use-after-free on disconnect
2019-10-17 13:40:59 -07:00
uwb
uwb: hwa-rc: fix memory leak at probe
2018-10-10 08:52:04 +02:00
vfio
vfio_pci: Restore original state on release
2019-10-07 21:01:00 +02:00
vhost
vhost: make sure log_num < in_num
2019-09-16 08:13:36 +02:00
video
video: ssd1307fb: Start page range at page_offset
2019-10-07 21:00:59 +02:00
virt
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
2019-05-16 19:45:18 +02:00
virtio
virtio_balloon: fix another race between migration and ballooning
2018-08-06 16:24:42 +02:00
vlynq
…
vme
…
w1
w1: fix the resume command API
2019-06-11 12:23:55 +02:00
watchdog
watchdog: bcm2835_wdt: Fix module autoload
2019-09-06 10:18:15 +02:00
xen
xen/pci: reserve MCFG areas earlier
2019-10-17 13:40:55 -07:00
zorro
zorro: Set up z->dev.dma_mask for the DMA API
2018-05-30 07:49:11 +02:00
Kconfig
…
Makefile
…