nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity
kernel/drivers/usb/cdns3
History
Frank Li cd45f99034 usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() 
...
  cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
  list_del_init(&priv_req->list);
  ...

'priv_req' actually free at cdns3_gadget_ep_free_request(). But
list_del_init() use priv_req->list after it.

[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4
[ 1542.642868][  T534]
[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):
[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4
[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]
[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4
[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8
[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368
[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28

Move list_del_init() before cdns3_gadget_ep_free_request() to resolve this
problem.

Cc: stable@vger.kernel.org
Fixes: 7733f6c32e ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Roger Quadros <rogerq@kernel.org>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20240202154217.661867-1-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-02-19 09:30:41 +01:00
..
cdns3-debug.h usb: cdns3: change trace event cdns3_ring() operation 2023-03-09 15:35:03 +01:00
cdns3-ep0.c
cdns3-gadget.c usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() 2024-02-19 09:30:41 +01:00
cdns3-gadget.h usb: cdns3: fix iso transfer error when mult is not zero 2024-01-04 16:01:44 +01:00
cdns3-imx.c usb: cdns3: imx: Rework system PM to avoid duplicated operations 2023-05-29 15:53:48 +01:00
cdns3-pci-wrap.c usb: cdns3: Fix issue with using incorrect PCI device function 2023-03-16 12:43:42 +01:00
cdns3-plat.c usb: cdns3: Use dev_err_probe 2023-12-15 13:55:56 +01:00
cdns3-starfive.c usb: cdns3: starfive: don't misuse /** comment 2023-12-11 09:08:12 +01:00
cdns3-ti.c usb: Explicitly include correct DT includes 2023-07-25 18:20:02 +02:00
cdns3-trace.c
cdns3-trace.h usb: cdns3: change some trace event __dynamic_array() to __get_buf() 2023-03-09 15:35:03 +01:00
cdnsp-debug.h usb: cdnsp: Replace snprintf() with the safer scnprintf() variant 2023-12-04 22:25:17 +09:00
cdnsp-ep0.c usb: cdnsp: Fixes error: uninitialized symbol 'len' 2023-04-05 19:55:04 +02:00
cdnsp-gadget.c usb:cdnsp: remove TRB_FLUSH_ENDPOINT command 2023-10-27 12:56:37 +02:00
cdnsp-gadget.h usb:cdnsp: remove TRB_FLUSH_ENDPOINT command 2023-10-27 12:56:37 +02:00
cdnsp-mem.c
cdnsp-pci.c usb: cdns3: Put the cdns set active part outside the spin lock 2023-07-25 17:49:25 +02:00
cdnsp-ring.c usb: cdnsp: Fix deadlock issue during using NCM gadget 2023-11-21 15:29:14 +01:00
cdnsp-trace.c
cdnsp-trace.h usb: cdns3: change some trace event __dynamic_array() to __get_buf() 2023-03-09 15:35:03 +01:00
core.c usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers 2024-02-19 09:30:41 +01:00
core.h usb: cdns3: Modify the return value of cdns_set_active () to void when CONFIG_PM_SLEEP is disabled 2023-10-02 14:25:39 +02:00
drd.c usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers 2024-02-19 09:30:41 +01:00
drd.h usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers 2024-02-19 09:30:41 +01:00
gadget-export.h
host-export.h
host.c usb: cdnsp: blocked some cdns3 specific code 2024-02-19 09:30:41 +01:00
Kconfig usb: cdns3: Add StarFive JH7110 USB driver 2023-05-29 15:52:11 +01:00
Makefile usb: cdns3: Add StarFive JH7110 USB driver 2023-05-29 15:52:11 +01:00