Jia-Ju Bai 6e967c1805 usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() ...

commit c85400f886 upstream.

The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
be concurrently executed.
The two functions both access a possible shared variable "hep->hcpriv".

This shared variable is freed by r8a66597_endpoint_disable() via the
call path:
r8a66597_endpoint_disable
  kfree(hep->hcpriv) (line 1995 in Linux-4.19)

This variable is read by r8a66597_urb_enqueue() via the call path:
r8a66597_urb_enqueue
  spin_lock_irqsave(&r8a66597->lock)
  init_pipe_info
    enable_r8a66597_pipe
      pipe = hep->hcpriv (line 802 in Linux-4.19)

The read operation is protected by a spinlock, but the free operation
is not protected by this spinlock, thus a concurrency use-after-free bug
may occur.

To fix this bug, the spin-lock and spin-unlock function calls in
r8a66597_endpoint_disable() are moved to protect the free operation.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-15 10:49:27 +09:00

..

whci

whci: Remove deprecated create_singlethread_workqueue

2016-08-15 16:25:58 +02:00

bcma-hcd.c

USB: bcma: drop Northstar PHY 2.0 initialization code

2016-09-27 12:20:17 +02:00

ehci-atmel.c

usb: ehci-atmel: use __maybe_unused to hide pm functions

2016-03-03 20:37:41 -08:00

ehci-dbg.c

usb: host: fix incorrect updating of offset

2017-12-09 22:01:57 +01:00

ehci-exynos.c

usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths

2017-05-14 14:00:18 +02:00

ehci-fsl.c

drivers/usb/host/fsl: Port USB EHCI host driver for LS102xA

2016-01-24 20:37:47 -08:00

ehci-fsl.h

drivers: usb: fsl: Define usb control register mask for w1c bits

2015-07-22 16:44:35 -07:00

ehci-grlib.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ehci-hcd.c

USB: host: ehci-sead3: Remove SEAD-3 EHCI code

2016-10-05 01:31:20 +02:00

ehci-hub.c

USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN

2016-06-01 14:56:24 -07:00

ehci-mem.c

USB-EHCI: Delete unnecessary checks before the function call "dma_pool_destroy"

2015-12-01 14:26:33 -08:00

ehci-msm.c

usb: host: ehci-msm: Conditionally call ehci suspend/resume

2016-06-07 22:15:25 -07:00

ehci-mv.c

host: ehci-mv: remove duplicate check on resource

2014-11-07 09:01:50 -08:00

ehci-mxc.c

host: ehci-mxc: remove duplicate check on resource

2014-11-07 09:01:50 -08:00

ehci-omap.c

usb/host/: const data must use __initconst not __initdata

2016-04-28 12:35:36 -07:00

ehci-orion.c

usb: ehci-orion: fix probe for !GENERIC_PHY

2015-10-04 10:45:08 +01:00

ehci-pci.c

ehci-hcd: Disable memory-write-invalidate when the driver is removed

2016-01-24 20:51:34 -08:00

ehci-platform.c

usb: ehci-platform: increase EHCI_MAX_RSTS to 4

2016-10-24 14:29:08 +02:00

ehci-pmcmsp.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ehci-ppc-of.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ehci-ps3.c

usb: hcd: move controller wakeup setting initialization to individual driver

2013-12-08 18:06:46 -08:00

ehci-q.c

USB: EHCI: improvements to unlink_empty_async_suspended()

2016-02-03 13:14:52 -08:00

ehci-sched.c

usb: host: ehci-sched: remove unnecessary braces

2016-02-03 13:44:05 -08:00

ehci-sh.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ehci-spear.c

usb/host/: const data must use __initconst not __initdata

2016-04-28 12:35:36 -07:00

ehci-st.c

usb: host: ehci-st: Inform the reset framework that our reset line may be shared

2016-06-30 07:44:21 +01:00

ehci-sysfs.c

usb: host: ehci-sys: delete useless bus_to_hcd conversion

2015-08-18 10:05:23 -07:00

ehci-tegra.c

usb: host: ehci-tegra: Avoid getting the same reset twice

2016-06-07 22:15:25 -07:00

ehci-tilegx.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ehci-timer.c

USB: EHCI: add a delay when unlinking an active QH

2016-02-03 13:14:52 -08:00

ehci-w90x900.c

Merge tag 'driver-core-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2014-12-14 16:10:09 -08:00

ehci-xilinx-of.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ehci.h

usb: host: unhide suspend/resume declarations

2016-03-03 20:37:41 -08:00

fhci-dbg.c

drivers/usb/host/fhci-dbg.c: remove unnecessary null test before debugfs_remove

2014-07-09 16:13:03 -07:00

fhci-hcd.c

usb: host: fhci-hcd: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

fhci-hub.c

QE: Move QE from arch/powerpc to drivers/soc

2015-12-22 17:12:56 -06:00

fhci-mem.c

USB: make hcd.h public (drivers dependency)

2010-05-20 13:21:30 -07:00

fhci-q.c

USB: make hcd.h public (drivers dependency)

2010-05-20 13:21:30 -07:00

fhci-sched.c

USB: FHCI: avoid redundant condition

2016-05-09 13:08:46 +02:00

fhci-tds.c

usb: whci: fhci: remove comparison to bool

2015-12-04 08:25:58 -08:00

fhci.h

QE: Move QE from arch/powerpc to drivers/soc

2015-12-22 17:12:56 -06:00

fotg210-hcd.c

usb/host/fotg210: remove dead code in create_sysfs_files

2016-05-09 13:08:46 +02:00

fotg210.h

usb/host/fotg210: Fix coding style issues

2015-10-16 23:46:22 -07:00

fsl-mph-dr-of.c

usb: host: fsl-mph-dr-of: use of_property_read_bool

2016-08-09 15:49:01 +02:00

hwa-hc.c

Amlogic: sync the code from mainline. [1/1]

2020-02-04 13:48:58 +09:00

imx21-dbg.c

usb: kill DEBUG compile option

2013-12-03 10:34:33 -08:00

imx21-hcd.c

imx21-hcd: use USB_DT_HUB

2015-04-03 19:03:18 +02:00

imx21-hcd.h

usb: kill DEBUG compile option

2013-12-03 10:34:33 -08:00

isp116x-hcd.c

USB: isp116x-hcd.c: move assignment out of if () block

2015-05-10 16:01:11 +02:00

isp116x.h

USB: isp116x: remove dependency on CONFIG_USB_DEBUG

2013-07-23 16:35:17 -07:00

isp1362-hcd.c

isp1362-hcd: use USB_DT_HUB

2015-04-03 19:03:18 +02:00

isp1362.h

USB: isp1362: move debug files from proc to debugfs

2013-07-24 14:43:05 -07:00

Kconfig

usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT

2018-02-22 15:43:51 +01:00

Makefile

usb: xhci: Add NVIDIA Tegra XUSB controller driver

2016-04-29 16:48:58 +02:00

max3421-hcd.c

usb: host: max3421-hcd: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

ohci-at91.c

usb: ohci-at91: Do not drop unhandled USB suspend control requests

2017-03-18 19:14:31 +08:00

ohci-da8xx.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ohci-dbg.c

USB: ohci-dbg.c: move assignment out of if () block

2015-05-10 16:01:11 +02:00

ohci-exynos.c

usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths

2017-05-14 14:00:18 +02:00

ohci-hcd.c

USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM

2018-05-25 16:13:01 +02:00

ohci-hub.c

ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func()

2018-02-28 10:18:31 +01:00

ohci-mem.c

USB: OHCI: add I/O watchdog for orphan TDs

2014-07-18 16:34:07 -07:00

ohci-nxp.c

usb: ohci: nxp: remove USB PLL and USB OTG clock management

2016-03-03 20:38:53 -08:00

ohci-omap3.c

usb: hcd: move controller wakeup setting initialization to individual driver

2013-12-08 18:06:46 -08:00

ohci-omap.c

USB: ohci-omap - avoid including mach/irqs.h

2016-08-30 19:31:33 +02:00

ohci-pci.c

ohci-pci: add qemu quirk

2017-05-25 15:44:36 +02:00

ohci-platform.c

ohci-platform: Add support for controllers with multiple reset lines

2016-06-07 22:21:41 -07:00

ohci-ppc-of.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ohci-ps3.c

usb: hcd: move controller wakeup setting initialization to individual driver

2013-12-08 18:06:46 -08:00

ohci-pxa27x.c

usb: host: ohci-pxa27x: propagate the irq error code

2016-02-14 17:06:43 -08:00

ohci-q.c

usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

2018-02-28 10:18:31 +01:00

ohci-s3c2410.c

ohci-s3c2410: use HUB_CHAR_*

2015-01-25 21:01:13 +08:00

ohci-sa1111.c

usb: ohci-sa1111: remove mach/hardware.h include

2016-08-30 19:24:59 +02:00

ohci-sm501.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ohci-spear.c

usb: host: ohci-spear: Fix module autoload for OF platform driver

2015-10-04 10:51:58 +01:00

ohci-st.c

usb: host: ohci-st: Inform the reset framework that our reset line may be shared

2016-06-30 07:44:20 +01:00

ohci-tilegx.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

ohci-tmio.c

USB: OHCI: fix bad #define in ohci-tmio.c

2015-07-22 14:49:42 -07:00

ohci.h

ohci-pci: add qemu quirk

2017-05-25 15:44:36 +02:00

oxu210hp-hcd.c

usb: host: oxu210hp-hcd: use list_for_each_entry_safe

2016-01-24 20:55:33 -08:00

oxu210hp.h

USB: replace uses of __constant_{endian}

2009-03-24 16:20:33 -07:00

pci-quirks.c

xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround

2017-10-12 11:51:18 +02:00

pci-quirks.h

xhci: Bad Ethernet performance plugged in ASM1042A host

2017-07-27 15:08:01 -07:00

r8a66597-hcd.c

usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()

2023-05-15 10:49:27 +09:00

r8a66597.h

usb/host/r8a66597: remove conditional compilation of clk code

2012-07-30 17:25:12 -07:00

sl811_cs.c

usb: delete non-required instances of include <linux/init.h>

2014-01-08 15:01:39 -08:00

sl811-hcd.c

Merge tag 'usb-for-v4.1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing

2015-04-10 13:45:27 +02:00

sl811.h

USB: sl811: move debug files from proc to debugfs

2013-07-24 14:43:05 -07:00

ssb-hcd.c

USB: ssb: use devm_kzalloc

2015-06-08 14:26:22 -07:00

u132-hcd.c

usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()

2023-05-15 08:20:31 +09:00

uhci-debug.c

new helpers: no_seek_end_llseek{,_size}()

2015-12-23 10:41:31 -05:00

uhci-grlib.c

usb: host: drop owner assignment from platform_drivers

2015-01-09 12:31:53 -08:00

uhci-hcd.c

usb: host: uhci-hcd: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

uhci-hcd.h

USB: UHCI: remove unused definition

2013-01-24 13:42:09 -08:00

uhci-hub.c

Merge tag 'usb-for-v4.1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing

2015-04-10 13:45:27 +02:00

uhci-pci.c

USB: UHCI: report non-PME wakeup signalling for Intel hardware

2017-01-06 10:40:11 +01:00

uhci-platform.c

usb: host: uhci-platform: Fix module autoload for OF platform driver

2015-10-04 10:51:58 +01:00

uhci-q.c

usb : replace dma_pool_alloc and memset with dma_pool_zalloc

2015-12-01 14:26:33 -08:00

xhci-dbg.c

usb: host: xhci-dbg: HCIVERSION should be a binary number

2017-03-18 19:14:32 +08:00

xhci-ext-caps.h

xhci: harden xhci_find_next_ext_cap against device removal

2016-02-04 17:00:10 -08:00

xhci-hub.c

xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only

2023-05-15 10:45:18 +09:00

xhci-mem.c

ODROID-COMMON: drivers/usb: code featuring for internal USB or external

2020-03-26 17:12:06 +09:00

xhci-mtk-sch.c

usb: xhci-mtk: fix bpkts value of LS/HS periodic eps not behind TT

2016-02-03 14:01:47 -08:00

xhci-mtk.c

usb: xhci-mtk: resume USB3 roothub first

2023-05-15 08:40:17 +09:00

xhci-mtk.h

xhci: mediatek: support MTK xHCI host controller

2015-12-01 10:45:51 -08:00

xhci-mvebu.c

usb: host: xhci: plat: change type of mvebu init_quirk()

2016-04-26 16:08:02 -07:00

xhci-mvebu.h

usb: host: xhci: plat: change type of mvebu init_quirk()

2016-04-26 16:08:02 -07:00

xhci-pci.c

xhci: Add missing CAS workaround for Intel Sunrise Point xHCI

2023-05-15 08:40:16 +09:00

xhci-plat.c

Merge branch 'android-4.9' into amlogic-4.9-dev

2018-05-22 10:48:42 +08:00

xhci-plat.h

usb: host: xhci: plat: finally get rid of xhci_plat_type_is()

2016-04-26 16:08:02 -07:00

xhci-rcar.c

usb: host: xhci: rcar: retire use of xhci_plat_type_is()

2016-04-26 16:08:02 -07:00

xhci-rcar.h

usb: host: xhci-plat: add support for the R-Car H3 xHCI controllers

2015-12-01 10:45:51 -08:00

xhci-ring.c

usb: xhci: fix uninitialized completion when USB3 port got wrong status

2023-05-15 09:59:18 +09:00

xhci-tegra.c

usb: xhci: remove the code build warning

2023-05-12 17:04:58 +09:00

xhci-trace.c

xhci: Export symbols used by host-controller drivers

2014-10-03 14:44:45 -07:00

xhci-trace.h

tracing: Add TRACE_SYSTEM_VAR to xhci-hcd

2015-04-07 12:31:55 -04:00

xhci.c

xhci: Prevent U1/U2 link pm states if exit latency is too long

2023-05-15 10:26:51 +09:00

xhci.h

usb: xhci: fix timeout for transition from RExit to U0

2023-05-15 09:57:22 +09:00