raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-07 10:29:52 +00:00
Code Issues Projects Releases Wiki Activity
Files
af2dfddd003209adf70a62d9308316faff398b51
linux/drivers/usb/host
History
Jia-Ju Bai 5f28980d51 usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() 
commit c85400f886 upstream.

The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
be concurrently executed.
The two functions both access a possible shared variable "hep->hcpriv".

This shared variable is freed by r8a66597_endpoint_disable() via the
call path:
r8a66597_endpoint_disable
  kfree(hep->hcpriv) (line 1995 in Linux-4.19)

This variable is read by r8a66597_urb_enqueue() via the call path:
r8a66597_urb_enqueue
  spin_lock_irqsave(&r8a66597->lock)
  init_pipe_info
    enable_r8a66597_pipe
      pipe = hep->hcpriv (line 802 in Linux-4.19)

The read operation is protected by a spinlock, but the free operation
is not protected by this spinlock, thus a concurrency use-after-free bug
may occur.

To fix this bug, the spin-lock and spin-unlock function calls in
r8a66597_endpoint_disable() are moved to protect the free operation.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-09 17:45:53 +01:00
..
whci
USB: host: whci: remove redundant variable t
2018-07-13 15:41:56 +02:00
bcma-hcd.c
USB: host: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-atmel.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-dbg.c
USB: ehci-hcd: no need to check return value of debugfs_create functions
2018-05-31 12:54:22 +02:00
ehci-exynos.c
usb: host: exynos: Remove support for Exynos5440
2018-07-24 18:44:00 +02:00
ehci-fsl.c
usb: add a flag to skip PHY initialization to struct usb_hcd
2018-03-09 09:43:52 -08:00
ehci-fsl.h
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-grlib.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-hcd.c
usb: host: Replace empty define with do while
2018-09-28 15:03:37 +02:00
ehci-hub.c
USB: ehci-hcd: Add get_resuming_ports method
2018-06-25 21:44:43 +08:00
ehci-mem.c
Revert "usb: host: ehci: Use dma_pool_zalloc()"
2018-05-04 14:35:12 -07:00
ehci-mv.c
USB: EHCI: ehci-mv: add DT support
2018-09-20 13:07:55 +02:00
ehci-mxc.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-npcm7xx.c
USB: host: ehci-npcm7xx: Fix some error codes in probe
2018-06-28 19:32:42 +09:00
ehci-omap.c
USB: ehci-omap: drop unused legacy phy support
2018-04-22 15:58:23 +02:00
ehci-orion.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-pci.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-platform.c
usb: host: ehci-platform: remove custom USB PHY handling
2018-03-09 09:43:53 -08:00
ehci-pmcmsp.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-ppc-of.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ehci-ps3.c
powerpc/ps3: Set driver coherent_dma_mask
2018-07-20 12:50:37 +10:00
ehci-q.c
usb: host: Replace empty define with do while
2018-09-28 15:03:37 +02:00
ehci-sched.c
usb: host: ehci-sched: remove redundant pointer dev
2018-07-13 15:41:56 +02:00
ehci-sh.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-spear.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-st.c
pinctrl: files should directly include apis they use
2018-02-05 09:41:54 -08:00
ehci-sysfs.c
USB: move many drivers to use DEVICE_ATTR_RW
2018-01-24 08:49:51 +01:00
ehci-tegra.c
usb: tegra: Move utmi-pads reset from ehci-tegra to tegra-phy
2018-04-23 09:50:57 +02:00
ehci-timer.c
usb: host: Replace empty define with do while
2018-09-28 15:03:37 +02:00
ehci-w90x900.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci-xilinx-of.c
USB: host: ehci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ehci.h
usb: host: Replace empty define with do while
2018-09-28 15:03:37 +02:00
fhci-dbg.c
USB: fhci-hcd: no need to check return value of debugfs_create functions
2018-05-31 12:54:22 +02:00
fhci-hcd.c
USB: host: fhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
fhci-hub.c
USB: host: fhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
fhci-mem.c
USB: host: fhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
fhci-q.c
USB: host: fhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
fhci-sched.c
USB: host: fhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
fhci-tds.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
fhci.h
USB: fhci-hcd: no need to check return value of debugfs_create functions
2018-05-31 12:54:22 +02:00
fotg210-hcd.c
usb: host: Replace empty define with do while
2018-09-28 15:03:37 +02:00
fotg210.h
usb: host: Replace empty define with do while
2018-09-28 15:03:37 +02:00
fsl-mph-dr-of.c
USB: host: Remove redundant license text
2017-11-07 15:45:02 +01:00
hwa-hc.c
USB: check usb_get_extra_descriptor for proper size
2018-12-05 21:20:14 +01:00
imx21-dbg.c
USB: imx21-hcd: no need to check return value of debugfs_create functions
2018-05-31 12:54:22 +02:00
imx21-hcd.c
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
imx21-hcd.h
USB: host: imx21: Remove redundant license text
2017-11-07 15:45:02 +01:00
isp116x-hcd.c
USB: isp116x-hcd: no need to check return value of debugfs_create functions
2018-05-31 12:54:21 +02:00
isp116x.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
isp1362-hcd.c
usb: host: isp1362-hcd: remove a couple of redundant assignments
2017-11-07 15:52:29 +01:00
isp1362.h
usb: isp1362: remove blackfin arch glue
2018-03-26 15:57:14 +02:00
Kconfig
USB: EHCI: make ehci-mv a separate driver
2018-09-20 13:07:55 +02:00
Makefile
USB: EHCI: make ehci-mv a separate driver
2018-09-20 13:07:55 +02:00
max3421-hcd.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-at91.c
usb: host: ohci-at91: fix request of irq for optional gpio
2018-10-15 15:57:29 +02:00
ohci-da8xx.c
USB: ohci: da8xx: remove clk con_id
2018-01-09 16:15:19 +01:00
ohci-dbg.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
ohci-exynos.c
usb: host: exynos: Remove support for Exynos5440
2018-07-24 18:44:00 +02:00
ohci-hcd.c
USB: ohci: no need to check return value of debugfs_create functions
2018-05-31 12:54:21 +02:00
ohci-hub.c
ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func()
2018-02-15 18:43:57 +01:00
ohci-mem.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-nxp.c
USB: host: ohci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ohci-omap.c
usb: add a flag to skip PHY initialization to struct usb_hcd
2018-03-09 09:43:52 -08:00
ohci-pci.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-platform.c
usb: host: ohci-platform: remove custom USB PHY handling
2018-03-09 09:43:53 -08:00
ohci-ppc-of.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-ps3.c
powerpc/ps3: Set driver coherent_dma_mask
2018-07-20 12:50:37 +10:00
ohci-pxa27x.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-q.c
usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()
2018-02-15 18:45:34 +01:00
ohci-s3c2410.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-sa1111.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-sm501.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
ohci-spear.c
USB: host: ohci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ohci-st.c
USB: host: ohci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ohci-tmio.c
USB: host: ohci: Remove redundant license text
2017-11-07 15:45:02 +01:00
ohci.h
USB: ohci: no need to check return value of debugfs_create functions
2018-05-31 12:54:21 +02:00
oxu210hp-hcd.c
treewide: setup_timer() -> timer_setup()
2017-11-21 15:57:07 -08:00
oxu210hp.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pci-quirks.c
USB: OHCI: Remove USB bus reset delay from OHCI handover code
2018-09-10 20:05:02 +02:00
pci-quirks.h
Revert "xhci: Reset Renesas uPD72020x USB controller for 32-bit DMA issue"
2018-06-01 13:24:51 +02:00
r8a66597-hcd.c
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
2019-01-09 17:45:53 +01:00
r8a66597.h
USB: host: Remove redundant license text
2017-11-07 15:45:02 +01:00
sl811_cs.c
USB: add SPDX identifiers to all remaining files in drivers/usb/
2017-11-04 11:48:02 +01:00
sl811-hcd.c
USB: host: sl811: Re-use DEFINE_SHOW_ATTRIBUTE() macro
2018-03-16 15:40:19 +01:00
sl811.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
ssb-hcd.c
USB: host: Remove redundant license text
2017-11-07 15:45:02 +01:00
u132-hcd.c
usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
2018-09-05 14:36:53 +02:00
uhci-debug.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
uhci-grlib.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
uhci-hcd.c
USB: uhci: no need to check return value of debugfs_create functions
2018-05-31 12:54:21 +02:00
uhci-hcd.h
usb: uhci: Add clk support to uhci-platform
2018-01-17 15:08:56 +01:00
uhci-hub.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
uhci-pci.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
uhci-platform.c
usb: uhci: Add clk support to uhci-platform
2018-01-17 15:08:56 +01:00
uhci-q.c
USB: remove the URB_NO_FSBR flag
2017-12-12 13:16:07 +01:00
xhci-dbg.c
usb: xhci: Cleanup printk debug message for ERST
2017-12-08 17:43:52 +01:00
xhci-dbgcap.c
Merge 4.18-rc5 into usb-next
2018-07-16 09:09:24 +02:00
xhci-dbgcap.h
usb: xhci: dbc: Add SPDX identifiers to dbc files
2018-05-24 18:03:07 +02:00
xhci-dbgtty.c
usb: xhci: dbc: Add SPDX identifiers to dbc files
2018-05-24 18:03:07 +02:00
xhci-debugfs.c
xhci: debugfs: add debugfs interface to enable compliance mode for a port
2018-05-24 18:03:09 +02:00
xhci-debugfs.h
USB: host: xhci-debugfs: add SPDX lines
2017-11-07 15:53:48 +01:00
xhci-ext-caps.c
xhci: Add Intel extended cap / otg phy mux handling
2018-03-22 13:40:10 +01:00
xhci-ext-caps.h
xhci: Add Intel extended cap / otg phy mux handling
2018-03-22 13:40:10 +01:00
xhci-histb.c
xhci: Fix leaking USB3 shared_hcd at xhci removal
2018-11-09 08:31:08 -08:00
xhci-hub.c
xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
2018-12-14 13:02:55 +01:00
xhci-mem.c
usb: xhci: fix interrupt transfer error happened on MTK platforms
2018-09-10 20:40:29 +02:00
xhci-mtk-sch.c
usb: xhci-mtk: supports SSP without external USB3 gen2 hub
2018-09-28 15:04:45 +02:00
xhci-mtk.c
xhci: Fix leaking USB3 shared_hcd at xhci removal
2018-11-09 08:31:08 -08:00
xhci-mtk.h
usb: xhci-mtk: supports bandwidth scheduling with multi-TT
2018-09-28 15:04:45 +02:00
xhci-mvebu.c
USB: host: xhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
xhci-mvebu.h
USB: host: xhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
xhci-pci.c
xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
2018-12-06 13:00:10 +01:00
xhci-plat.c
xhci: Fix leaking USB3 shared_hcd at xhci removal
2018-11-09 08:31:08 -08:00
xhci-plat.h
USB: host: xhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
xhci-rcar.c
usb: host: xhci-rcar: Add a condition check about PLL active
2018-07-06 16:37:19 +02:00
xhci-rcar.h
USB: host: xhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
xhci-ring.c
xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc
2018-11-09 08:31:09 -08:00
xhci-tegra.c
xhci: Fix leaking USB3 shared_hcd at xhci removal
2018-11-09 08:31:08 -08:00
xhci-trace.c
USB: host: xhci: Remove redundant license text
2017-11-07 15:45:02 +01:00
xhci-trace.h
xhci: Fix kernel oops in trace_xhci_free_virt_device
2018-06-25 21:16:27 +08:00
xhci.c
xhci: Prevent U1/U2 link pm states if exit latency is too long
2018-12-06 13:00:10 +01:00
xhci.h
USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd
2018-12-17 16:01:02 +01:00