Kaixin Wang 6185072577 i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition ... In the svc_i3c_master_probe function, &master->hj_work is bound with svc_i3c_master_hj_work, &master->ibi_work is bound with svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work can start the hj_work, svc_i3c_master_irq_handler can start the ibi_work. If we remove the module which will call svc_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | svc_i3c_master_hj_work svc_i3c_master_remove | i3c_master_unregister(&master->base)| device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in svc_i3c_master_remove. Fixes: 0f74f8b667 ("i3c: Make i3c_master_unregister() return void") Cc: stable@vger.kernel.org Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/stable/20240914154030.180-1-kxwang23%40m.fudan.edu.cn Link: https://lore.kernel.org/r/20240914163932.253-1-kxwang23@m.fudan.edu.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>		2024-09-17 16:51:45 +02:00
..
master	i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition	2024-09-17 16:51:45 +02:00
device.c	i3c: Add comment for -EAGAIN in i3c_device_do_priv_xfers()	2024-05-23 00:29:19 +02:00
internals.h	i3c: master: Enhance i3c_bus_type visibility for device searching & event monitoring	2024-07-26 14:21:30 +02:00
Kconfig
Makefile
master.c	i3c: master: support to adjust first broadcast address speed	2024-09-17 16:46:22 +02:00