linux-kernel - Re: [PATCH 2/3] bus: mhi: pci_generic: Fix possible use-after-free in mhi_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 9 Jun 2021 18:59:16 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
Cc:     hemantk@...eaurora.org, bbhatt@...eaurora.org,
        linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
        jarvis.w.jiang@...il.com, loic.poulain@...aro.org,
        Wei Yongjun <weiyongjun1@...wei.com>,
        Hulk Robot <hulkci@...wei.com>
Subject: Re: [PATCH 2/3] bus: mhi: pci_generic: Fix possible use-after-free
 in mhi_pci_remove()

On Sun, Jun 06, 2021 at 09:07:40PM +0530, Manivannan Sadhasivam wrote:
> From: Wei Yongjun <weiyongjun1@...wei.com>
> 
> This driver's remove path calls del_timer(). However, that function
> does not wait until the timer handler finishes. This means that the
> timer handler may still be running after the driver's remove function
> has finished, which would result in a use-after-free.
> 
> Fix by calling del_timer_sync(), which makes sure the timer handler
> has finished, and unable to re-schedule itself.
> 
> Fixes: 8562d4fe34a3 ("mhi: pci_generic: Add health-check")
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Signed-off-by: Wei Yongjun <weiyongjun1@...wei.com>
> Reviewed-by: Hemant kumar <hemantk@...eaurora.org>
> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
> Reviewed-by: Loic Poulain <loic.poulain@...aro.org>
> Link: https://lore.kernel.org/r/20210413160318.2003699-1-weiyongjun1@huawei.com
> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
> ---
>  drivers/bus/mhi/pci_generic.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

No Cc: stable on this?  I'll go add it...