openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity
linux/drivers/net/usb
History
Tuomas Tynkkynen b835a71ef6 usbnet: smsc95xx: Fix use-after-free after removal 
Syzbot reports an use-after-free in workqueue context:

BUG: KASAN: use-after-free in mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737
 mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737
 __smsc95xx_mdio_read drivers/net/usb/smsc95xx.c:217 [inline]
 smsc95xx_mdio_read+0x583/0x870 drivers/net/usb/smsc95xx.c:278
 check_carrier+0xd1/0x2e0 drivers/net/usb/smsc95xx.c:644
 process_one_work+0x777/0xf90 kernel/workqueue.c:2274
 worker_thread+0xa8f/0x1430 kernel/workqueue.c:2420
 kthread+0x2df/0x300 kernel/kthread.c:255

It looks like that smsc95xx_unbind() is freeing the structures that are
still in use by the concurrently running workqueue callback. Thus switch
to using cancel_delayed_work_sync() to ensure the work callback really
is no longer active.

Reported-by: syzbot+29dc7d4ae19b703ff947@syzkaller.appspotmail.com
Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2020-06-22 16:34:31 -07:00
..
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile net: usb: aqc111: Driver skeleton for Aquantia AQtion USB to 5GbE 2018-11-27 15:46:06 -08:00
aqc111.c aqc111: cleanup mtu related logic 2019-05-16 14:22:13 -07:00
aqc111.h net: usb: aqc111: Use the correct style for SPDX License Identifier 2019-11-27 11:27:01 -08:00
asix.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
asix_common.c net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32 2019-07-22 20:44:14 -07:00
asix_devices.c net: usb: asix: init MAC address buffers 2019-07-02 15:24:48 -07:00
ax88172a.c net: convert suitable drivers to use phy_do_ioctl_running 2020-01-23 10:49:30 +01:00
ax88179_178a.c net: usb: ax88179_178a: fix packet alignment padding 2020-06-17 14:58:11 -07:00
catc.c netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
cdc-phonet.c net: usb: cdc-phonet: Replace zero-length array with flexible-array member 2020-02-17 19:05:05 -08:00
cdc_eem.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
cdc_ether.c r8152: support additional Microsoft Surface Ethernet Adapter variant 2020-05-19 12:45:09 -07:00
cdc_mbim.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cdc_ncm.c cdc_ncm: Fix the build warning 2020-03-15 00:41:29 -07:00
cdc_subset.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
ch9200.c net: ch9200: remove unnecessary return 2020-01-07 13:30:36 -08:00
cx82310_eth.c cx82310_eth: fix a memory leak bug 2019-08-18 13:01:54 -07:00
dm9601.c
…
gl620a.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
hso.c usb: hso: correct debug message 2020-05-07 12:59:33 -07:00
huawei_cdc_ncm.c net: huawei_cdc_ncm: remove redundant assignment to variable ret 2020-05-10 11:13:07 -07:00
int51x1.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
ipheth.c netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
kalmia.c net: kalmia: fix memory leaks 2019-08-18 13:03:21 -07:00
kaweth.c netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
lan78xx.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-26 10:40:21 +01:00
lan78xx.h net: lan78xx: Switch to SPDX identifier 2018-09-05 22:20:45 -07:00
lg-vl600.c net: usb: Delete unnecessary checks before the macro call “dev_kfree_skb” 2019-08-22 16:22:03 -07:00
mcs7830.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
net1080.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
pegasus.c pegasus: Remove pegasus' own workqueue 2020-04-02 17:58:25 -07:00
pegasus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
plusb.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
qmi_wwan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-05-31 17:48:46 -07:00
r8152.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-05-24 13:47:27 -07:00
rndis_host.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
rtl8150.c netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
sierra_net.c net: sierra_net: Remove unused inline function 2020-05-05 12:07:43 -07:00
smsc75xx.c net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32 2019-07-22 20:44:14 -07:00
smsc75xx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
smsc95xx.c usbnet: smsc95xx: Fix use-after-free after removal 2020-06-22 16:34:31 -07:00
smsc95xx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
sr9700.c drivers: net: Remove unnecessary semicolon 2019-03-01 23:13:49 -08:00
sr9700.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
sr9800.c net: usb: sr9800: fix uninitialized local variable 2019-10-15 21:02:12 -07:00
sr9800.h
…
usbnet.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-12-22 15:15:05 -08:00
zaurus.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00