Zheng Wang 047bd9c03a memstick: r592: Fix UAF bug in r592_remove due to race condition ... ANBZ: #5681 commit 6326442278 upstream. In r592_probe, dev->detect_timer was bound with r592_detect_timer. In r592_irq function, the timer function will be invoked by mod_timer. If we remove the module which will call hantro_release to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in r592_remove. CPU0 CPU1 |r592_detect_timer r592_remove | memstick_free_host| put_device; | kfree(host); | | | queue_work | &host->media_checker //use Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Link: https://lore.kernel.org/r/20230307164338.1246287-1-zyytlz.wz@163.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Fixes: CVE-2023-35825 Signed-off-by: Xiao Long <xiaolong@openanolis.org> Reviewed-by: Xunlei Pang <xlpang@linux.alibaba.com> Link: https://gitee.com/anolis/cloud-kernel/pulls/1816		2023-07-04 01:37:28 +00:00
..
core	memstick: avoid out-of-range warning	2021-11-18 14:04:07 +01:00
host	memstick: r592: Fix UAF bug in r592_remove due to race condition	2023-07-04 01:37:28 +00:00
Kconfig	…
Makefile	…