Linux kernel stable tree https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/atom?h=linux-5.12.y 2021-07-14T14:59:20+00:00 2021-07-14T14:59:20+00:00 Tong Zhang ztong0001@gmail.com 2021-05-11T16:39:45+00:00 urn:sha1:ab9bb64a95a6d32a175a4902067feb90255dfc18 [ Upstream commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 ] This patch fixes the following issues: 1. memstick_free_host() will free the host, so the use of ms_dev(host) after it will be a problem. To fix this, move memstick_free_host() after when we are done with ms_dev(host). 2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove and free host otherwise memstick_check will be called and UAF will happen. [ 11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] [ 11.357077] rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] [ 11.357376] platform_remove+0x2a/0x50 [ 11.367531] Freed by task 298: [ 11.368537] kfree+0xa4/0x2a0 [ 11.368711] device_release+0x51/0xe0 [ 11.368905] kobject_put+0xa2/0x120 [ 11.369090] rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms] [ 11.369386] platform_remove+0x2a/0x50 [ 12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0 [ 12.045432] mutex_lock+0xc9/0xd0 [ 12.046080] memstick_check+0x6a/0x578 [memstick] [ 12.046509] process_one_work+0x46d/0x750 [ 12.052107] Freed by task 297: [ 12.053115] kfree+0xa4/0x2a0 [ 12.053272] device_release+0x51/0xe0 [ 12.053463] kobject_put+0xa2/0x120 [ 12.053647] rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms] [ 12.053939] platform_remove+0x2a/0x50 Signed-off-by: Tong Zhang <ztong0001@gmail.com> Co-developed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2020-12-04T11:27:10+00:00 Jing Xiangfeng jingxiangfeng@huawei.com 2020-11-25T01:47:18+00:00 urn:sha1:db29d3d1c2451e673e29c7257471e3ce9d50383a Fix to return a error code from the error handling case instead of 0. Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader") Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com> Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-11-24T10:26:55+00:00 Qinglang Miao miaoqinglang@huawei.com 2020-11-20T07:48:46+00:00 urn:sha1:e3e9ced5c93803d5b2ea1942c4bf0192622531d6 kfree(host->card) has been called in put_device so that another kfree would raise cause a double-free bug. Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-11-16T10:59:28+00:00 Tom Rix trix@redhat.com 2020-10-31T14:27:56+00:00 urn:sha1:a85344d347284cc3d81e8fc230788d3f82b9bb45 A semicolon is not needed after a switch statement. Signed-off-by: Tom Rix <trix@redhat.com> Link: https://lore.kernel.org/r/20201031142756.2140029-1-trix@redhat.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-11-16T10:59:28+00:00 Tom Rix trix@redhat.com 2020-10-31T13:48:18+00:00 urn:sha1:8c3c0aca1a0cef20ac739b63f26971849b0f453a A semicolon is not needed after a switch statement. Signed-off-by: Tom Rix <trix@redhat.com> Link: https://lore.kernel.org/r/20201031134818.2135446-1-trix@redhat.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-11-16T10:59:28+00:00 Tom Rix trix@redhat.com 2020-10-31T14:25:05+00:00 urn:sha1:fb8298631b11ba81e4326f8a8e54505e8439d28d A semicolon is not needed after a switch statement. Signed-off-by: Tom Rix <trix@redhat.com> Link: https://lore.kernel.org/r/20201031142505.2139539-1-trix@redhat.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-09-28T10:17:36+00:00 Ulf Hansson ulf.hansson@linaro.org 2020-09-28T10:17:36+00:00 urn:sha1:21685f9a7d7cdb3f68d83352377571fb24d03134 2020-09-28T10:16:13+00:00 Kai-Heng Feng kai.heng.feng@canonical.com 2020-09-25T08:49:51+00:00 urn:sha1:62c59a8786e6bb75569cee91dab66e9da3ff4b68 After commit 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management"), removing module rtsx_usb_ms will be stuck. The deadlock is caused by powering on and powering off at the same time, the former one is when memstick_check() is flushed, and the later is called by memstick_remove_host(). Soe let's skip allocating card to prevent this issue. Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Link: https://lore.kernel.org/r/20200925084952.13220-1-kai.heng.feng@canonical.com Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-09-07T07:11:28+00:00 Colin Ian King colin.king@canonical.com 2020-08-10T08:02:47+00:00 urn:sha1:309de450d78e9e83036f8b696596d8e7aa078f0d There is a spelling mistake in a debug message. Fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Link: https://lore.kernel.org/r/20200810080247.47024-1-colin.king@canonical.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 2020-08-23T22:36:59+00:00 Gustavo A. R. Silva gustavoars@kernel.org 2020-08-23T22:36:59+00:00 urn:sha1:df561f6688fef775baa341a0f5d960becd248b11 Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>