R0dn3yS/android_kernel_xiaomi_sm7250
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
lineage-20.0
android_kernel_xiaomi_sm7250/drivers/atm
History
Duoming Zhou 52fddbd975 atm: idt77252: fix use-after-free bugs caused by tst_timer 
commit 3f4093e2bf4673f218c0bf17d8362337c400e77b upstream.

There are use-after-free bugs caused by tst_timer. The root cause
is that there are no functions to stop tst_timer in idt77252_exit().
One of the possible race conditions is shown below:

    (thread 1)          |        (thread 2)
                        |  idt77252_init_one
                        |    init_card
                        |      fill_tst
                        |        mod_timer(&card->tst_timer, ...)
idt77252_exit           |  (wait a time)
                        |  tst_timer
                        |
                        |    ...
  kfree(card) // FREE   |
                        |    card->soft_tst[e] // USE

The idt77252_dev is deallocated in idt77252_exit() and used in
timer handler.

This patch adds del_timer_sync() in idt77252_exit() in order that
the timer handler could be stopped before the idt77252_dev is
deallocated.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:15:39 +02:00
..
.gitignore [ATM]: Ignore generated file pca200e_ecd.bin2 2006-12-11 14:34:35 -08:00
adummy.c atm: make atmdev_ops const 2017-08-09 22:43:50 -07:00
ambassador.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-29 13:10:25 -08:00
ambassador.h ATM: Delete no use FILL_RX_POOLS_IN_BH marco 2011-07-08 09:06:31 -07:00
atmtcp.c atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent 2020-08-11 15:32:33 +02:00
eni.c atm: eni: Add check for dma_map_single 2022-03-23 09:10:44 +01:00
eni.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
firestream.c atm: firestream: check the return value of ioremap() in fs_init() 2022-03-23 09:10:41 +01:00
firestream.h atm: firestream: remove duplicate define 2013-10-21 18:46:46 -04:00
fore200e.c fore200e: Fix incorrect checks of NULL pointer dereference 2020-02-24 08:34:42 +01:00
fore200e.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
he.c atm: he: fix sign-extension overflow on large shift 2019-02-27 10:08:57 +01:00
he.h atm: remove deprecated use of pci api 2015-01-18 00:28:41 -05:00
horizon.c treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
horizon.h
idt77105.c atm: idt77252: fix null-ptr-dereference 2021-03-30 14:36:58 +02:00
idt77105.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
idt77252_tables.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
idt77252.c atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-25 11:15:39 +02:00
idt77252.h atm: idt77252: Convert timers to use timer_setup() 2017-10-18 12:39:38 +01:00
iphase.c atm: iphase: fix possible use-after-free in ia_module_exit() 2021-07-20 16:15:59 +02:00
iphase.h scripts/spelling.txt: add "followings" pattern and fix typo instances 2017-02-27 18:43:47 -08:00
Kconfig Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105 2019-09-21 07:16:57 +02:00
lanai.c atm: lanai: dont run lanai_dev_close if not open 2021-03-30 14:36:57 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
midway.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nicstar.c atm: nicstar: register the interrupt handler in the right place 2021-07-20 16:16:01 +02:00
nicstar.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nicstarmac.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nicstarmac.copyright drivers/atm/: remove CVS keywords 2008-05-20 14:52:25 -07:00
solos-attrlist.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
solos-pci.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
suni.c atm: suni: remove extraneous space to fix indentation 2017-11-28 16:03:09 -05:00
suni.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tonga.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
uPD98401.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
uPD98402.c atm: uPD98402: fix incorrect allocation 2021-03-30 14:36:58 +02:00
uPD98402.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
zatm.c atm: zatm: Fix empty body Clang warnings 2019-12-01 09:16:41 +01:00
zatm.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
zeprom.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00