leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
26b75952ca
linux/drivers/usb/gadget/udc
History
Yang Yingliang a932ee40c2 usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove() 
This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210407092947.3271507-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-09 16:02:33 +02:00
..
aspeed-vhub usb: gadget: aspeed: fix dma map failure 2021-04-02 15:39:30 +02:00
bdc usb: bdc: Make bdc pci driver depend on BROKEN 2021-01-19 14:10:46 +01:00
amd5536udc_pci.c usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference 2021-03-23 13:25:07 +01:00
amd5536udc.h usb: gadget: Replace HTTP links with HTTPS ones 2020-07-15 16:33:52 +02:00
at91_udc.c usb: gadget: at91_udc: remove useless cast for driver.name 2020-02-19 11:10:25 +01:00
at91_udc.h
atmel_usba_udc.c usb: gadget: udc: atmel: update endpoint allocation for sam9x60 2020-09-24 11:56:17 +03:00
atmel_usba_udc.h usb: gadget: udc: atmel: update endpoint allocation for sam9x60 2020-09-24 11:56:17 +03:00
bcm63xx_udc.c usb: gadget: bcm63xx_udc: fix up the error of undeclared usb_debug_root 2020-10-02 09:57:43 +03:00
core.c Merge v5.11-rc5 into usb-next 2021-01-25 11:23:27 +01:00
dummy_hcd.c USB: gadget: dummy-hcd: remove redundant initialization of variable 'value' 2021-03-10 09:37:15 +01:00
fotg210-udc.c fotg210-udc: Complete OUT requests on short packets 2021-03-26 14:43:47 +01:00
fotg210.h
fsl_qe_udc.c usb/gadget: fsl_qe_udc: convert tasklets to use new tasklet_setup() API 2020-08-18 13:00:01 +02:00
fsl_qe_udc.h usb: Spelling s/enpoint/endpoint/ 2019-11-04 15:53:00 +01:00
fsl_udc_core.c usb: gadget: fsl: fix null pointer checking 2020-10-27 10:57:24 +02:00
fsl_usb2_udc.h
fusb300_udc.c usb: gadget: fusb300_udc: remove useless cast for driver.name 2020-02-19 11:10:25 +01:00
fusb300_udc.h
goku_udc.c usb: gadget: goku_udc: fix potential crashes in probe 2020-10-27 10:55:45 +02:00
goku_udc.h
gr_udc.c Linux 5.8-rc6 2020-07-20 09:41:30 +02:00
gr_udc.h usb: gadget: Replace HTTP links with HTTPS ones 2020-07-15 16:33:52 +02:00
Kconfig usb: gadget: fsl_mxc_udc: Remove the driver 2020-12-28 15:41:33 +01:00
lpc32xx_udc.c usb: gadget: lpc32xx_udc: Convert to DEFINE_SHOW_ATTRIBUTE 2020-10-02 09:57:39 +03:00
m66592-udc.c usb: gadget: fix potential double-free in m66592_probe. 2020-05-25 11:09:43 +03:00
m66592-udc.h
Makefile usb: gadget: fsl_mxc_udc: Remove the driver 2020-12-28 15:41:33 +01:00
max3420_udc.c usb: gadget: Replace HTTP links with HTTPS ones 2020-07-15 16:33:52 +02:00
mv_u3d_core.c usb: gadget: udc: mv_u3d_core: Remove unused static const 'driver_desc' 2020-07-09 17:19:58 +02:00
mv_u3d.h usb: Spelling s/enpoint/endpoint/ 2019-11-04 15:53:00 +01:00
mv_udc_core.c usb: gadget: udc: mv_udc_core: Remove unused static const variable 'driver_desc' 2020-07-09 17:19:57 +02:00
mv_udc.h
net2272.c USB: UDC: net2272: Fix memory leaks 2020-10-02 09:57:42 +03:00
net2272.h USB: UDC: net2272: Fix memory leaks 2020-10-02 09:57:42 +03:00
net2280.c USB: changes for v5.10 merge window 2020-10-03 15:59:57 +02:00
net2280.h USB: UDC: net2280: Fix memory leaks 2020-10-02 09:57:42 +03:00
omap_udc.c usb: gadget: Use fallthrough pseudo-keyword 2020-07-10 08:55:18 +02:00
omap_udc.h
pch_udc.c usb: gadget: pch_udc: Convert Intel Quark quirk to use driver data 2021-03-26 14:44:17 +01:00
pxa25x_udc.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pxa25x_udc.h
pxa27x_udc.c usb: gadget: pxa27x_udc: Replace in_interrupt() usage in comments 2020-10-28 13:05:42 +01:00
pxa27x_udc.h
r8a66597-udc.c usb: gadget: r8a66597: Add missing null check on return from platform_get_resource 2021-04-09 16:02:26 +02:00
r8a66597-udc.h
renesas_usb3.c usb: roles: Provide the switch drivers handle to the switch in the API 2020-03-04 11:12:50 +01:00
s3c2410_udc_regs.h usb: gadget: s3c: use platform resources 2020-08-19 20:58:22 +02:00
s3c2410_udc.c usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()' 2021-03-28 14:07:18 +02:00
s3c2410_udc.h usb: gadget: s3c: use platform resources 2020-08-19 20:58:22 +02:00
s3c-hsudc.c usb: gadget: s3c-hsudc: remove platform header dependency 2020-08-19 20:58:27 +02:00
snps_udc_core.c USB: gadget: udc: Process disconnect synchronously 2021-01-19 13:31:25 +01:00
snps_udc_plat.c USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() 2021-04-02 15:40:38 +02:00
tegra-xudc.c usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove() 2021-04-09 16:02:33 +02:00
trace.c
trace.h
udc-xilinx.c usb: gadget: Assign boolean values to a bool variable 2021-02-09 11:58:55 +01:00