Shin'ichiro Kawasaki ccd1751092 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() ... commit 928ea98252 upstream. In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-06-22 14:22:04 +02:00
..
accessibility	speakup-dectlk: Restore pitch setting	2022-02-16 12:56:37 +01:00
acpi	ACPI: property: Release subnode properties with data nodes	2022-06-09 10:23:20 +02:00
amba	…
android	binder: avoid potential data leakage when copying txn	2022-01-27 11:04:09 +01:00
ata	ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()	2022-06-22 14:21:56 +02:00
atm	atm: eni: Add check for dma_map_single	2022-03-23 09:16:41 +01:00
auxdisplay	auxdisplay: lcd2s: Use proper API to free the instance of charlcd object	2022-03-08 19:12:47 +01:00
base	init: Initialize noop_backing_dev_info early	2022-06-22 14:22:02 +02:00
bcma	…
block	nbd: fix io hung while disconnecting device	2022-06-14 18:36:24 +02:00
bluetooth	Bluetooth: hci_qca: Use del_timer_sync() before freeing	2022-06-06 08:43:40 +02:00
bus	bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()	2022-06-22 14:22:04 +02:00
cdrom	…
char	random: credit cpu and bootloader seeds by default	2022-06-22 14:21:58 +02:00
clk	clk: tegra: Add missing reset deassertion	2022-06-09 10:23:29 +02:00
clocksource	clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()	2022-06-22 14:21:59 +02:00
comedi	comedi: vmk80xx: fix expression for tx buffer size	2022-06-22 14:22:03 +02:00
connector	…
counter	…
cpufreq	cpufreq: mediatek: Unregister platform device on exit	2022-06-09 10:23:14 +02:00
cpuidle	cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode	2022-06-09 10:22:33 +02:00
crypto	crypto: sun8i-ss - handle zero sized sg	2022-06-09 10:23:11 +02:00
cxl	cxl/regs: Fix size of CXL Capability Header Register	2022-04-08 14:23:30 +02:00
dax	dax: make sure inodes are flushed before destroy cache	2022-04-08 14:23:31 +02:00
dca	…
devfreq	PM / devfreq: rk3399_dmc: Disable edev on remove()	2022-06-09 10:22:41 +02:00
dio	…
dma	dmaengine: idxd: add missing callback function to support DMA_INTERRUPT	2022-06-14 18:36:28 +02:00
dma-buf	dma-buf: ensure unique directory name for dmabuf stats	2022-05-25 09:57:29 +02:00
edac	EDAC/dmc520: Don't print an error for each unconfigured interrupt line	2022-06-09 10:22:47 +02:00
eisa	…
extcon	extcon: Modify extcon device to be created after driver data is set	2022-06-14 18:36:22 +02:00
firewire	firewire: core: extend card->lock in fw_core_handle_bus_reset	2022-05-12 12:30:05 +02:00
firmware	firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle	2022-06-14 18:36:09 +02:00
fpga	…
fsi	fsi: Aspeed: Fix a potential double free	2022-04-08 14:23:44 +02:00
gnss	…
gpio	gpio: dwapb: Don't print error on -EPROBE_DEFER	2022-06-22 14:21:58 +02:00
gpu	drm/i915/reset: Fix error_state_read ptr + offset use	2022-06-22 14:22:00 +02:00
greybus	greybus: svc: fix an error handling bug in gb_svc_hello()	2022-04-08 14:22:50 +02:00
hid	HID: amd_sfh: Modify the hid name	2022-06-09 10:22:56 +02:00
hsi	HSI: core: Fix return freed object in hsi_new_client	2022-01-27 11:04:31 +01:00
hv	Drivers: hv: vmbus: Release cpu lock in error case	2022-06-22 14:22:00 +02:00
hwmon	hwmon: (pmbus) Check PEC support before reading other registers	2022-06-09 10:23:02 +02:00
hwspinlock	…
hwtracing	coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier	2022-06-14 18:36:06 +02:00
i2c	i2c: designware: Use standard optional ref clock implementation	2022-06-22 14:22:02 +02:00
i3c	i3c: master: dw: check return of dw_i3c_master_get_free_pos()	2022-03-08 19:12:37 +01:00
idle	…
iio	iio: st_sensors: Add a local lock for protecting odr	2022-06-14 18:36:20 +02:00
infiniband	RDMA/rxe: Generate a completion for unsupported/invalid opcode	2022-06-09 10:23:31 +02:00
input	Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq	2022-06-22 14:21:57 +02:00
interconnect	interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate	2022-06-09 10:23:31 +02:00
iommu	iommu/arm-smmu-v3: check return value after calling platform_get_resource()	2022-06-14 18:36:14 +02:00
ipack	…
irqchip	irqchip/realtek-rtl: Fix refcount leak in map_interrupts	2022-06-22 14:22:02 +02:00
isdn	isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()	2022-03-16 14:23:36 +01:00
leds	leds: lp55xx: initialise output direction from dts	2022-01-27 11:04:21 +01:00
macintosh	macintosh: via-pmu and via-cuda need RTC_LIB	2022-06-09 10:23:12 +02:00
mailbox	mailbox: forward the hrtimer if not queued and under a lock	2022-06-09 10:23:12 +02:00
mcb	…
md	md/raid0: Ignore RAID0 layout if the second zone has only one device	2022-06-14 18:36:28 +02:00
media	media: coda: Add more H264 levels for CODA960	2022-06-09 10:23:25 +02:00
memory	memory: samsung: exynos5422-dmc: Avoid some over memory allocation	2022-06-09 10:23:04 +02:00
memstick	…
message	…
mfd	mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()	2022-06-09 10:23:12 +02:00
misc	mei: me: add raptor lake point S DID	2022-06-22 14:22:03 +02:00
mmc	mmc: block: Fix CQE recovery reset success	2022-06-14 18:36:25 +02:00
most	…
mtd	ubi: ubi_create_volume: Fix use-after-free when volume creation failed	2022-06-14 18:36:10 +02:00
mux	…
net	net: bgmac: Fix an erroneous kfree() in bgmac_remove()	2022-06-22 14:22:01 +02:00
nfc	nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred	2022-06-22 14:21:58 +02:00
ntb	ntb: intel: fix port config status offset for SPR	2022-03-08 19:12:44 +01:00
nubus	…
nvdimm	nvdimm: Allow overwrite in the presence of disabled dimms	2022-06-09 10:23:08 +02:00
nvme	nvme: add device name to warning in uuid_show()	2022-06-22 14:22:01 +02:00
nvmem	nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property	2022-03-02 11:48:06 +01:00
of	of: overlay: do not break notify on NOTIFY_{OK|STOP}	2022-06-09 10:22:50 +02:00
opp	OPP: call of_node_put() on error path in _bandwidth_supported()	2022-06-09 10:23:13 +02:00
parisc	parisc: Fix CPU affinity for Lasi, WAX and Dino chips	2022-04-13 20:59:14 +02:00
parport	…
pci	PCI: qcom: Fix pipe clock imbalance	2022-06-14 18:36:28 +02:00
pcmcia	pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards	2022-06-14 18:36:02 +02:00
perf	arm_pmu: Validate single/group leader events	2022-04-27 14:39:00 +02:00
phy	phy: qcom-qmp: fix pipe-clock imbalance on power-on failure	2022-06-14 18:36:06 +02:00
pinctrl	pinctrl/rockchip: support setting input-enable param	2022-06-09 10:23:32 +02:00
platform	platform/x86/intel: hid: Add Surface Go to VGBS allow list	2022-06-22 14:21:59 +02:00
pnp	…
power	extcon: Fix extcon_get_extcon_dev() error handling	2022-06-14 18:36:21 +02:00
powercap	…
pps	pps: clients: gpio: Propagate return value from pps_gpio_probe	2022-04-08 14:23:44 +02:00
ps3	…
ptp	ptp: replace snprintf with sysfs_emit	2022-04-13 20:59:01 +02:00
pwm	pwm: raspberrypi-poe: Fix endianness in firmware struct	2022-06-14 18:36:04 +02:00
rapidio	…
ras	…
regulator	regulator: scmi: Fix refcount leak in scmi_regulator_probe	2022-06-09 10:23:00 +02:00
remoteproc	remoteproc: imx_rproc: Ignore create mem entry for resource table	2022-06-14 18:36:03 +02:00
reset	reset: tegra-bpmp: Restore Handle errors in BPMP response	2022-04-27 14:38:55 +02:00
rpmsg	rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails	2022-06-14 18:36:05 +02:00
rtc	rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe	2022-06-14 18:36:07 +02:00
s390	s390/stp: clock_delta should be signed	2022-06-09 10:23:21 +02:00
sbus	…
scsi	scsi: pmcraid: Fix missing resource cleanup in error case	2022-06-22 14:21:57 +02:00
sh	…
siox	…
slimbus	slimbus: qcom: Fix IRQ check in qcom_slim_probe	2022-05-18 10:26:55 +02:00
soc	soc: rockchip: Fix refcount leak in rockchip_grf_init	2022-06-14 18:36:07 +02:00
soundwire	soundwire: qcom: adjust autoenumeration timeout	2022-06-14 18:36:21 +02:00
spi	spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()	2022-06-09 10:22:55 +02:00
spmi	…
ssb	…
staging	staging: r8188eu: Fix warning of array overflow in ioctl_linux.c	2022-06-22 14:21:59 +02:00
target	target: remove an incorrect unmap zeroes data deduction	2022-06-09 10:22:47 +02:00
tc	…
tee	optee: use driver internal tee_context for some rpc	2022-03-02 11:47:51 +01:00
thermal	thermal: devfreq_cooling: use local ops instead of global ops	2022-06-09 10:23:26 +02:00
thunderbolt	thunderbolt: Use different lane for second DisplayPort tunnel	2022-06-14 18:36:20 +02:00
tty	serial: 8250: Store to lsr_save_flags after lsr read	2022-06-22 14:22:04 +02:00
uio	…
usb	usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()	2022-06-22 14:22:04 +02:00
vdpa	vduse: Fix NULL pointer dereference on sysfs access	2022-06-14 18:36:26 +02:00
vfio	vfio/pci: Fix vf_token mechanism when device-specific VF drivers are used	2022-04-20 09:34:13 +02:00
vhost	vringh: Fix loop descriptors check in the indirect cases	2022-06-14 18:36:24 +02:00
video	video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()	2022-06-14 18:36:15 +02:00
virt	virt: acrn: fix a memory leak in acrn_dev_ioctl()	2022-04-08 14:23:50 +02:00
virtio	virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed	2022-06-22 14:21:58 +02:00
visorbus	…
vlynq	…
vme	…
w1	w1: w1_therm: fixes w1_seq for ds28ea00 sensors	2022-04-13 20:59:11 +02:00
watchdog	watchdog: wdat_wdt: Stop watchdog when rebooting the system	2022-06-14 18:36:22 +02:00
xen	xen: unexport __init-annotated xen_xlate_map_ballooned_pages()	2022-06-14 18:36:17 +02:00
zorro	…
Kconfig	…
Makefile	…