leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
88153e29c1
linux/drivers
History
Tong Zhang 8ee9d82cd0 epic100: fix use after free on rmmod 
epic_close() calls epic_rx() and uses dma buffer, but in epic_remove_one()
we already freed the dma buffer. To fix this issue, reorder function calls
like in the .probe function.

BUG: KASAN: use-after-free in epic_rx+0xa6/0x7e0 [epic100]
Call Trace:
 epic_rx+0xa6/0x7e0 [epic100]
 epic_close+0xec/0x2f0 [epic100]
 unregister_netdev+0x18/0x20
 epic_remove_one+0xaa/0xf0 [epic100]

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Yilun Wu <yiluwu@cs.stonybrook.edu>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Reviewed-by: Francois Romieu <romieu@fr.zoreil.com>
Link: https://lore.kernel.org/r/20220627043351.25615-1-ztong0001@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-06-27 21:48:51 -07:00
..
accessibility Revert "speakup: Generate speakupmap.h automatically" 2022-05-20 21:07:05 +02:00
acpi More power management updates for 5.19-rc1 2022-05-30 11:37:26 -07:00
amba Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
android fix for breakage in #work.fd this window 2022-06-05 17:14:03 -07:00
ata ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files 2022-06-09 09:25:25 +09:00
atm
auxdisplay
base Merge tag 'fs_for_v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2022-06-17 10:09:24 -07:00
bcma
block xen: branch for v5.19-rc1b 2022-06-04 13:42:53 -07:00
bluetooth Bluetooth: btmtksdio: fix the reset takes too long 2022-05-13 13:19:01 +02:00
bus bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() 2022-06-10 15:53:12 +02:00
cdrom cdrom: remove obsolete TODO list 2022-05-15 18:31:28 -06:00
char Char/Misc driver fixes for 5.19-rc3 2022-06-17 07:58:39 -07:00
clk Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
clocksource clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() 2022-06-08 12:27:08 +00:00
comedi comedi: vmk80xx: fix expression for tx buffer size 2022-06-10 15:21:23 +02:00
connector
counter
cpufreq ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
cpuidle Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
crypto virtio-crypto: enable retry for virtio-crypto-dev 2022-05-31 12:45:09 -04:00
cxl cxl/port: Enable HDM Capability after validating DVSEC Ranges 2022-05-20 12:30:53 -07:00
dax dax: add .recovery_write dax_operation 2022-05-16 13:37:59 -07:00
dca
devfreq PM / devfreq: passive: Return non-error when not-supported event is required 2022-05-19 19:32:19 +02:00
dio drivers: dio: add missing iounmap() in dio_init() 2022-05-19 18:56:51 +02:00
dma dmaengine updates for v5.19-rc1 2022-05-29 11:38:27 -07:00
dma-buf udmabuf: add back sanity check 2022-06-20 08:38:29 -05:00
edac - A gargen variety of fixes which don't fit any other tip bucket: 2022-05-23 19:32:59 -07:00
eisa
extcon
firewire firewire: convert sysfs sprintf/snprintf family to sysfs_emit 2022-06-17 10:43:20 +02:00
firmware efi: sysfb_efi: remove unnecessary <asm/efi.h> include 2022-06-21 18:11:43 +02:00
fpga
fsi
gnss
gpio gpio: dwapb: Don't print error on -EPROBE_DEFER 2022-06-10 14:26:15 +02:00
gpu two regression fixups 2022-06-17 11:32:35 +10:00
greybus
hid HID: hyperv: Correctly access fields declared as __le16 2022-06-08 12:28:13 +00:00
hsi
hte hte: Uninitialized variable in hte_ts_get() 2022-05-20 15:54:41 +02:00
hv Drivers: hv: vmbus: Release cpu lock in error case 2022-06-10 08:41:28 +00:00
hwmon hwmon: (asus-ec-sensors) add missing comma in board name list. 2022-06-15 08:14:38 -07:00
hwspinlock
hwtracing
i2c i2c: mediatek: Fix an error handling path in mtk_i2c_probe() 2022-06-14 22:11:54 +02:00
i3c i3c: master: svc: fix returnvar.cocci warning 2022-05-17 22:34:42 +02:00
idle cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE 2022-06-08 18:05:45 +02:00
iio Bitmap patches for 5.19-rc1 2022-06-04 14:04:27 -07:00
infiniband v5.19 pull request 2022-05-26 21:08:40 -07:00
input Input updates for v5.19-rc1 2022-06-07 15:00:29 -07:00
interconnect Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
iommu IOMMU Updates for Linux v5.19 2022-05-31 09:56:54 -07:00
ipack
irqchip irqchip/loongson-liointc: Use architecture register to get coreid 2022-06-10 08:57:19 +01:00
isdn
leds ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
macintosh macintosh: via-pmu and via-cuda need RTC_LIB 2022-05-22 15:58:30 +10:00
mailbox mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n 2022-05-24 08:08:24 -05:00
mcb
md block-5.19-2022-06-16 2022-06-17 11:22:58 -07:00
media USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
memory More power management updates for 5.19-rc1 2022-05-30 11:37:26 -07:00
memstick
message
mfd ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
misc Char/Misc driver fixes for 5.19-rc3 - take 2 2022-06-19 09:37:29 -05:00
mmc mmc: mediatek: wait dma stop bit reset to 0 2022-06-15 10:05:56 -07:00
most
mtd This pull request contains fixes for JFFS2, UBI and UBIFS 2022-06-03 14:42:24 -07:00
mux
net epic100: fix use after free on rmmod 2022-06-27 21:48:51 -07:00
nfc nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred 2022-06-08 10:18:10 -07:00
ntb
nubus
nvdimm cxl for 5.19 2022-05-27 21:24:19 -07:00
nvme nvme-pci: disable write zeros support on UMIC and Samsung SSDs 2022-06-13 19:56:57 +02:00
nvmem
of drm for 5.19-rc1 2022-05-25 16:18:27 -07:00
opp OPP updates for 5.19-rc1 2022-05-25 15:02:26 +02:00
parisc
parport
pci Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
pcmcia ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
peci
perf arm64 updates for 5.19: 2022-05-23 21:06:11 -07:00
phy phy-for-5.19 2022-05-19 16:56:17 +02:00
pinctrl Pin control bulk changes for the v5.19 series: 2022-05-28 11:15:54 -07:00
platform platform-drivers-x86 for v5.19-2 2022-06-12 11:33:42 -07:00
pnp
power Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
powercap Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
pps
ps3
ptp ptp: ptp_clockmatrix: fix is_single_shot 2022-05-25 21:51:32 -07:00
pwm pwm: pwm-cros-ec: Add channel type support 2022-05-20 16:40:01 +02:00
rapidio
ras
regulator Merge back reboot/poweroff notifiers rework for 5.19-rc1. 2022-05-25 14:38:29 +02:00
remoteproc
reset
rpmsg Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
rtc ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
s390 Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
sbus
scsi scsi: ibmvfc: Store vhost pointer during subcrq allocation 2022-06-16 21:42:04 -04:00
sh
siox
slimbus Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
soc Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
soundwire
spi Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
spmi
ssb
staging staging: rtl8723bs: Allocate full pwep structure 2022-06-10 09:10:16 +02:00
target blk-mq: remove the done argument to blk_execute_rq_nowait 2022-05-28 06:15:27 -06:00
tc
tee Fix a compiler warning in OP-TEE driver 2022-05-30 14:44:27 +02:00
thermal Additional thermal control update for 5.19-rc1 2022-05-30 11:34:13 -07:00
thunderbolt USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
tty serial: 8250: Store to lsr_save_flags after lsr read 2022-06-10 13:52:19 +02:00
ufs scsi: ufs: Fix a race between the interrupt handler and the reset handler 2022-06-16 21:32:09 -04:00
uio
usb usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io() 2022-06-10 14:45:38 +02:00
vdpa vduse: Fix NULL pointer dereference on sysfs access 2022-06-08 08:56:03 -04:00
vfio VFIO updates for v5.19-rc1 2022-06-01 13:49:15 -07:00
vhost vdpa: make get_vq_group and set_group_asid optional 2022-06-09 00:26:35 -04:00
video parisc architecture fixes & updates for kernel v5.19-rc1 2022-06-04 13:50:23 -07:00
virt Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
virtio virtio,vdpa: fixes 2022-06-11 16:32:47 -07:00
vlynq
vme
w1
watchdog watchdog: gxp: Add missing MODULE_LICENSE 2022-06-09 12:20:34 +02:00
xen xen: unexport __init-annotated xen_xlate_map_ballooned_pages() 2022-06-07 08:11:35 +02:00
zorro
Kconfig SCSI misc on 20220604 2022-06-05 09:25:12 -07:00
Makefile SCSI misc on 20220604 2022-06-05 09:25:12 -07:00