forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers
History
Zheyu Ma 28f28e4bc3 can: peak_pci: peak_pci_remove(): fix UAF 
commit 949fe9b355 upstream.

When remove the module peek_pci, referencing 'chan' again after
releasing 'dev' will cause UAF.

Fix this by releasing 'dev' later.

The following log reveals it:

[   35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537
[   35.965513 ] Call Trace:
[   35.965718 ]  dump_stack_lvl+0xa8/0xd1
[   35.966028 ]  print_address_description+0x87/0x3b0
[   35.966420 ]  kasan_report+0x172/0x1c0
[   35.966725 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967137 ]  ? trace_irq_enable_rcuidle+0x10/0x170
[   35.967529 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967945 ]  __asan_report_load8_noabort+0x14/0x20
[   35.968346 ]  peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.968752 ]  pci_device_remove+0xa9/0x250

Fixes: e6d9c80b7c ("can: peak_pci: add support of some new PEAK-System PCI cards")
Link: https://lore.kernel.org/all/1634192913-15639-1-git-send-email-zheyuma97@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-27 09:56:50 +02:00
..
accessibility
acpi acpi/arm64: fix next_platform_timer() section mismatch error 2021-10-20 11:45:06 +02:00
amba
android binder: make sure fd closes complete 2021-09-30 10:10:59 +02:00
ata ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() 2021-10-20 11:45:05 +02:00
atm atm: nicstar: register the interrupt handler in the right place 2021-07-19 09:44:52 +02:00
auxdisplay
base driver core: Reject pointless SYNC_STATE_ONLY device links 2021-10-20 11:45:01 +02:00
bcma bcma: Fix memory leak for internally-handled cores 2021-09-15 09:50:45 +02:00
block Revert "block: nbd: add sanity check for first_minor" 2021-09-16 12:51:23 +02:00
bluetooth Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS 2021-09-03 10:09:28 +02:00
bus drivers: bus: simple-pm-bus: Add support for probing simple bus only devices 2021-10-20 11:45:01 +02:00
cdrom
char tpm: ibmvtpm: Avoid error message when process gets signal while waiting 2021-09-15 09:50:30 +02:00
clk clk: socfpga: agilex: fix duplicate s2f_user0_clk 2021-10-20 11:44:58 +02:00
clocksource clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel 2021-09-15 09:50:29 +02:00
connector
counter counter: 104-quad-8: Return error when invalid mode during ceiling_write 2021-09-15 09:50:38 +02:00
cpufreq cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory 2021-10-06 15:55:46 +02:00
cpuidle cpuidle: pseries: Mark pseries_idle_proble() as __init 2021-09-18 13:40:12 +02:00
crypto crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() 2021-10-06 15:56:03 +02:00
dax
dca
devfreq PM / devfreq: Add missing error code in devfreq_add_device() 2021-07-14 16:56:11 +02:00
dio
dma dmaengine: xilinx_dma: Set DMA mask for coherent APIs 2021-09-26 14:09:00 +02:00
dma-buf dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER 2021-09-26 14:08:59 +02:00
edac EDAC/armada-xp: Fix output of uncorrectable error counter 2021-10-20 11:45:01 +02:00
eisa
extcon extcon: intel-mrfld: Sync hardware and software state on init 2021-07-19 09:45:00 +02:00
firewire
firmware efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() 2021-10-20 11:45:00 +02:00
fpga fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 2021-09-30 10:11:04 +02:00
fsi fsi: Add missing MODULE_DEVICE_TABLE 2021-07-20 16:05:42 +02:00
gnss
gpio gpio: pca953x: Improve bias setting 2021-10-20 11:45:03 +02:00
gpu drm/panel: ilitek-ili9881c: Fix sync for Feixin K101-IM2BYL02 panel 2021-10-27 09:56:49 +02:00
greybus
hid HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs 2021-10-17 10:43:32 +02:00
hsi
hv drivers: hv: Fix missing error code in vmbus_connect() 2021-07-14 16:55:59 +02:00
hwmon hwmon: (pmbus/ibm-cffps) max_power_out swap changes 2021-10-17 10:43:34 +02:00
hwspinlock
hwtracing intel_th: Wait until port is in reset before programming it 2021-07-20 16:05:46 +02:00
i2c i2c: mediatek: Add OFFSET_EXT_CONF setting back 2021-10-13 10:04:29 +02:00
i3c
ide
idle
iio iio: dac: ti-dac5571: fix an error code in probe() 2021-10-20 11:45:02 +02:00
infiniband RDMA/hns: Fix inaccurate prints 2021-10-06 15:55:55 +02:00
input Input: xpad - add support for another USB ID of Nacon GC-100 2021-10-20 11:45:00 +02:00
interconnect treewide: Change list_sort to use const pointers 2021-09-30 10:11:04 +02:00
iommu iommu/amd: Relocate GAMSup check to early_enable_iommus 2021-09-26 14:08:59 +02:00
ipack ipack: ipoctal: fix module reference leak 2021-10-06 15:56:01 +02:00
irqchip irqchip/gic: Work around broken Renesas integration 2021-10-09 14:40:57 +02:00
isdn mISDN: fix possible use-after-free in HFC_cleanup() 2021-07-19 09:44:38 +02:00
leds leds: trigger: audio: Add an activate callback to ensure the initial brightness is set 2021-09-15 09:50:36 +02:00
lightnvm
macintosh
mailbox soc: mediatek: cmdq: add address shift in jump 2021-09-18 13:40:16 +02:00
mcb mcb: fix error handling in mcb_alloc_bus() 2021-09-30 10:11:00 +02:00
md md: fix a lock order reversal in md_alloc 2021-09-30 10:11:05 +02:00
media media: ir_toy: prevent device from hanging during transmit 2021-10-06 15:55:49 +02:00
memory memory: tegra: Fix compilation warnings on 64bit platforms 2021-07-25 14:36:14 +02:00
memstick memstick: rtsx_usb_ms: fix UAF 2021-07-14 16:55:53 +02:00
message
mfd mfd: lpc_sch: Rename GPIOBASE to prevent build error 2021-09-22 12:28:06 +02:00
misc misc: fastrpc: Add missing lock before accessing find_vma() 2021-10-20 11:45:01 +02:00
mmc mmc: sdhci-of-at91: replace while loop with read_poll_timeout 2021-10-13 10:04:23 +02:00
most
mtd mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' 2021-09-22 12:28:04 +02:00
mux
net can: peak_pci: peak_pci_remove(): fix UAF 2021-10-27 09:56:50 +02:00
nfc nfc: nfcsim: fix use after free during module unload 2021-08-04 12:46:41 +02:00
ntb NTB: perf: Fix an error code in perf_setup_inbuf() 2021-09-22 12:28:02 +02:00
nubus
nvdimm libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind 2021-09-18 13:40:36 +02:00
nvme nvme-pci: Fix abort command id 2021-10-20 11:45:03 +02:00
nvmem nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells 2021-10-20 11:45:01 +02:00
of of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS 2021-09-18 13:40:31 +02:00
opp opp: Don't print an error if required-opps is missing 2021-09-18 13:40:29 +02:00
oprofile
parisc parisc: Move pci_dev_is_behind_card_dino to where it is used 2021-09-26 14:08:59 +02:00
parport parport: remove non-zero check on count 2021-09-18 13:40:34 +02:00
pci PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus 2021-10-13 10:04:25 +02:00
pcmcia pcmcia: i82092: fix a null pointer dereference bug 2021-08-12 13:22:16 +02:00
perf perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number 2021-07-14 16:56:08 +02:00
phy phy: intel: Fix for warnings due to EMMC clock 175Mhz change in FIP 2021-07-20 16:05:46 +02:00
pinctrl pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() 2021-09-18 13:40:14 +02:00
platform platform/x86: intel_scu_ipc: Fix busy loop expiry time 2021-10-20 11:45:06 +02:00
pnp
power power: supply: max17042: handle fails of reading status register 2021-09-18 13:40:08 +02:00
powercap
pps
ps3
ptp ptp_pch: Load module automatically if ID matches 2021-10-13 10:04:27 +02:00
pwm pwm: stm32-lp: Don't modify HW state in .remove() callback 2021-09-26 14:09:01 +02:00
rapidio
ras
regulator regulator: vctrl: Avoid lockdep warning in enable/disable ops 2021-09-15 09:50:30 +02:00
remoteproc remoteproc: k3-r5: Fix an error message 2021-07-20 16:05:50 +02:00
reset reset: reset-zynqmp: Fixed the argument data type 2021-09-08 08:49:00 +02:00
rpmsg
rtc rtc: rx8010: select REGMAP_I2C 2021-09-26 14:09:02 +02:00
s390 s390/qeth: fix NULL deref in qeth_clear_working_pool_list() 2021-09-30 10:11:03 +02:00
sbus
scsi scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 2021-10-17 10:43:33 +02:00
sfi
sh
siox
slimbus slimbus: ngd: reset dma setup during runtime pm 2021-08-26 08:35:55 -04:00
soc soc: ti: omap-prm: Fix external abort for am335x pruss 2021-10-13 10:04:26 +02:00
soundwire soundwire: intel: fix potential race condition during power down 2021-09-18 13:40:31 +02:00
spi spi: bcm-qspi: clear MSPI spifie interrupt during probe 2021-10-20 11:45:05 +02:00
spmi
ssb ssb: Fix error return code in ssb_bus_scan() 2021-07-14 16:56:21 +02:00
staging comedi: Fix memory leak in compat_insnlist() 2021-09-30 10:11:01 +02:00
target scsi: target: Fix the pgr/alua_support_store functions 2021-09-30 10:11:03 +02:00
tc
tee tee: optee: Fix missing devices unregister during optee_remove 2021-10-20 11:45:02 +02:00
thermal thermal/drivers/tsens: Fix wrong check for tzd in irq handlers 2021-10-09 14:40:57 +02:00
thunderbolt thunderbolt: Fix port linking by checking all adapters 2021-09-18 13:40:27 +02:00
tty tty: Fix out-of-bound vmalloc access in imageblit 2021-10-06 15:55:45 +02:00
uio
usb xhci: add quirk for host controllers that don't update endpoint DCS 2021-10-27 09:56:46 +02:00
vdpa vdpa/mlx5: Avoid destroying MR on empty iotlb 2021-08-26 08:35:42 -04:00
vfio vfio: Use config not menuconfig for VFIO_NOIOMMU 2021-09-18 13:40:12 +02:00
vhost vhost-vdpa: Fix the wrong input in config_cb 2021-10-20 11:45:04 +02:00
video video: fbdev: gbefb: Only instantiate device when built for IP32 2021-10-13 10:04:28 +02:00
virt
virtio virtio: write back F_VERSION_1 before validate 2021-10-20 11:45:01 +02:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-07-14 16:56:41 +02:00
vlynq
vme
w1 w1: ds2438: fixing bug that would always get page0 2021-07-20 16:05:39 +02:00
watchdog watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if appropriate 2021-09-22 12:28:01 +02:00
xen xen/balloon: fix cancelled balloon action 2021-10-13 10:04:24 +02:00
zorro
Kconfig
Makefile