Shin'ichiro Kawasaki ccd1751092 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() ... commit 928ea98252 upstream. In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-06-22 14:22:04 +02:00
..
fsl-mc	bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()	2022-06-22 14:22:04 +02:00
mhi	bus: mhi: host: pci_generic: Flush recovery worker during freeze	2022-05-09 09:14:30 +02:00
Kconfig	drivers: bus: Delete CONFIG_SIMPLE_PM_BUS	2021-10-05 17:47:22 +02:00
Makefile	drivers: bus: Delete CONFIG_SIMPLE_PM_BUS	2021-10-05 17:47:22 +02:00
arm-cci.c	…
arm-integrator-lm.c	…
brcmstb_gisb.c	…
bt1-apb.c	…
bt1-axi.c	…
da8xx-mstpri.c	…
hisi_lpc.c	…
imx-weim.c	…
intel-ixp4xx-eb.c	…
mips_cdmm.c	mips: cdmm: Fix refcount leak in mips_cdmm_phys_base	2022-04-08 14:23:39 +02:00
moxtet.c	…
mvebu-mbus.c	…
omap-ocp2scp.c	…
omap_l3_noc.c	…
omap_l3_noc.h	…
omap_l3_smx.c	…
omap_l3_smx.h	…
qcom-ebi2.c	…
simple-pm-bus.c	drivers: bus: simple-pm-bus: Add support for probing simple bus only devices	2021-10-05 17:47:15 +02:00
sun50i-de2.c	…
sunxi-rsb.c	bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()	2022-05-09 09:14:37 +02:00
tegra-aconnect.c	…
tegra-gmi.c	…
ti-pwmss.c	…
ti-sysc.c	bus: ti-sysc: Fix warnings for unbind for serial	2022-06-14 18:36:09 +02:00
ts-nbus.c	…
uniphier-system-bus.c	…
vexpress-config.c	…