MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-09-02 09:56:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
lf-6.6.y
linux-imx/drivers/greybus
History
Sicong Huang 0b8fba38bd greybus: Fix use-after-free bug in gb_interface_release due to race condition. 
commit 5c9c5d7f26 upstream.

In gb_interface_create, &intf->mode_switch_completion is bound with
gb_interface_mode_switch_work. Then it will be started by
gb_interface_request_mode_switch. Here is the relevant code.
if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
	...
}

If we call gb_interface_release to make cleanup, there may be an
unfinished work. This function will call kfree to free the object
"intf". However, if gb_interface_mode_switch_work is scheduled to
run after kfree, it may cause use-after-free error as
gb_interface_mode_switch_work will use the object "intf".
The possible execution flow that may lead to the issue is as follows:

CPU0                            CPU1

                            |   gb_interface_create
                            |   gb_interface_request_mode_switch
gb_interface_release        |
kfree(intf) (free)          |
                            |   gb_interface_mode_switch_work
                            |   mutex_lock(&intf->mutex) (use)

Fix it by canceling the work before kfree.

Signed-off-by: Sicong Huang <congei42@163.com>
Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
Cc: Ronnie Sahlberg <rsahlberg@ciq.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-21 14:38:48 +02:00
..
arpc.h greybus: Replace zero-length array with flexible-array 2020-05-13 13:59:13 +02:00
bundle.c
connection.c greybus: Use alloc_ordered_workqueue() to create ordered workqueues 2023-05-08 13:52:27 -10:00
control.c staging: greybus: move the greybus core to drivers/greybus 2019-08-27 19:03:04 +02:00
core.c driver core: make struct bus_type.uevent() take a const * 2023-01-27 13:45:52 +01:00
debugfs.c staging: greybus: move the greybus core to drivers/greybus 2019-08-27 19:03:04 +02:00
es2.c greybus: es2: fix typo in a comment 2021-12-21 10:13:26 +01:00
greybus_trace.h greybus: remove h from printk format specifier 2021-01-05 15:18:23 +01:00
hd.c
interface.c greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile
manifest.c staging: greybus: move the greybus core to drivers/greybus 2019-08-27 19:03:04 +02:00
module.c
operation.c
svc_watchdog.c staging: greybus: move the greybus core to drivers/greybus 2019-08-27 19:03:04 +02:00
svc.c greybus: Use alloc_ordered_workqueue() to create ordered workqueues 2023-05-08 13:52:27 -10:00