Tzung-Bi Shih 0acaf9cacd platform/chrome: cros_ec_debugfs: detach log reader wq from devm ... [ Upstream commit 0e8eb5e8ac ] Debugfs console_log uses devm memory (e.g. debug_info in cros_ec_console_log_poll()). However, lifecycles of device and debugfs are independent. An use-after-free issue is observed if userland program operates the debugfs after the memory has been freed. The call trace: do_raw_spin_lock _raw_spin_lock_irqsave remove_wait_queue ep_unregister_pollwait ep_remove do_epoll_ctl A Python example to reproduce the issue: ... import select ... p = select.epoll() ... f = open('/sys/kernel/debug/cros_scp/console_log') ... p.register(f, select.POLLIN) ... p.poll(1) [(4, 1)] # 4=fd, 1=select.POLLIN [ shutdown cros_scp at the point ] ... p.poll(1) [(4, 16)] # 4=fd, 16=select.POLLHUP ... p.unregister(f) An use-after-free issue raises here. It called epoll_ctl with EPOLL_CTL_DEL which in turn to use the workqueue in the devm (i.e. log_wq). Detaches log reader's workqueue from devm to make sure it is persistent even if the device has been removed. Signed-off-by: Tzung-Bi Shih <tzungbi@google.com> Reviewed-by: Guenter Roeck <groeck@google.com> Link: https://lore.kernel.org/r/20220209051130.386175-1-tzungbi@google.com Signed-off-by: Benson Leung <bleung@chromium.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-05-25 09:17:54 +02:00
..
chrome	platform/chrome: cros_ec_debugfs: detach log reader wq from devm	2022-05-25 09:17:54 +02:00
goldfish
mellanox	platform/mellanox: mlxreg-io: Fix read access of n-bytes size attributes	2021-10-20 11:45:05 +02:00
mips	MIPS: Loongson: Fix boot warning about hwmon_device_register()	2020-07-16 10:49:55 +02:00
olpc	Platform: OLPC: Fix probe error handling	2021-03-17 17:06:23 +01:00
x86	platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative	2022-04-27 13:53:53 +02:00
Kconfig
Makefile