November 2023 - Linux-stable-mirror

[PATCH v3] brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

by Zheng Wang

In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. Fixes: e756af5b30b0 ("brcmfmac: add e-scan support.") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Cc: stable(a)vger.kernel.org --- v3: - rename the subject as Johannes suggested v2: - fix the error of kernel test bot reported --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 667462369a32..646ec8bdf512 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -8431,6 +8431,9 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg) if (!cfg) return; + if (timer_pending(&cfg->escan_timeout)) + del_timer_sync(&cfg->escan_timeout); + cancel_work_sync(&cfg->escan_timeout_work); brcmf_pno_detach(cfg); brcmf_btcoex_detach(cfg); wiphy_unregister(cfg->wiphy); -- 2.25.1

1 year, 3 months

3
3
0 0

€ 100.000.000?

by ch.31hamnghi＠hcrc.vn

Goededag, Ik ben mevrouw Joanna Liu en een medewerker van Citi Bank Hong Kong. Kan ik € 100.000.000 aan u overmaken? Kan ik je vertrouwen Ik wacht op jullie reacties Met vriendelijke groeten mevrouw Joanna Liu

1 year, 3 months

1
0
0 0

PSR w/ high IRQ

by Mario Limonciello

Hi, There is a problem under high IRQ that PSR can hang. We've got a few bug reports like this. Can you please bring this commit into 6.5.y and 6.6.y: 79df45dc4bfb ("drm/amd/display: Don't use fsleep for PSR exit waits") This restores some of the behavior of the PSR interrupt handling to how it behaved in older kernels before it was changed in 6.4-rc1 by c69fc3d0de6ca. Thanks,

1 year, 3 months

2
1
0 0

Greetings

by Doris Martins

Greetings, I wonder why you continue neglecting my emails. Please, acknowledge the receipt of this message in reference to the subject above as I intend to send to you the details of the mail. Sometimes, try to check your spam box because most of these correspondences fall out sometimes in SPAM folder. Best regards,

1 year, 3 months

1
0
0 0

backport 0b4e3b6f6b79 and 35cad617df2e

by Benno Lossin

Hi, I noticed that without commit 0b4e3b6f6b79 ("rust: types: make `Opaque` be `!Unpin`") the `Opaque` type has an unsound API: The `Opaque` type is designed to wrap C types, hence it is often used to convert raw pointers to references in Rust. Normally `&mut` references are unique, but for `&mut Opaque<T>` this is should not be the case, since C also has pointers to the object. The way to disable the uniqueness guarantee for `&mut` in Rust is to make the type `!Unpin`. This is accomplished by the given commit above. At the time of creating that patch however, we did not consider this unsoundness issue. For this reason I propose to backport the commit 0b4e3b6f6b79. The only affected version is 6.5. No earlier version is affected, since the `Opaque` type does not exist in 6.1. Newer versions are also unaffected, since the patch is present in 6.6. Additionally I also propose to backport commit 35cad617df2e ("rust: make `UnsafeCell` the outer type in `Opaque`") to 6.5, as this is a prerequisite of 0b4e3b6f6b79. -- Cheers, Benno

1 year, 3 months

2
1
0 0

Backport of commit "power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint")

by Thomas Weißschuh

Dear stable team, I would like to propose the commit bbaa6ffa5b6c ("power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint") from mainline for inclusion into the stable kernels. The commit fixes a RCU violation as indicated in its commit message. Thanks, Thomas

1 year, 3 months

2
1
0 0

Request to backport commit f9cdeb58a9cf ("perf evlist: Avoid frequency mode for the dummy event") to stable versions of Linux kernel

by Mingwei Zhang

Hi Greg, Apology for any inconvenience. This is info and justification for patch. Commit-id: f9cdeb58a9cf46c09b56f5f661ea8da24b6458c3 Subject: perf evlist: Avoid frequency mode for the dummy event Justification: This patch fixes a critical performance issue at perf-tool level for anything running PMU in a virtualized environment. Majority of the justification is within the commit message. The only thing I would like to add is that this patch could save up to 50% of the vCPU time when running perf in sampling mode with a large number of events in the VM. Appreciate your help. -Mingwei

1 year, 3 months

2
1
0 0

[PATCH] wifi: cfg80211: Fix use-after-free bug in brcmf_cfg80211_detach

by Zheng Wang

In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. Fixes: e756af5b30b0 ("brcmfmac: add e-scan support.") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Cc: stable(a)vger.kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 667462369a32..0224e377eb6e 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -8431,6 +8431,9 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg) if (!cfg) return; + if (timer_pending(&cfg->escan_timeout)) + del_timer_sync(&cfg->escan_timeout); + cancel_delayed_work_sync(&cfg->escan_timeout_work); brcmf_pno_detach(cfg); brcmf_btcoex_detach(cfg); wiphy_unregister(cfg->wiphy); -- 2.25.1

1 year, 3 months

3
2
0 0

[PATCH v2] wifi: cfg80211: Fix use-after-free bug in brcmf_cfg80211_detach

by Zheng Wang

In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. Fixes: e756af5b30b0 ("brcmfmac: add e-scan support.") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Cc: stable(a)vger.kernel.org --- v2: - fix the error of kernel test bot reported --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 667462369a32..646ec8bdf512 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -8431,6 +8431,9 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg) if (!cfg) return; + if (timer_pending(&cfg->escan_timeout)) + del_timer_sync(&cfg->escan_timeout); + cancel_work_sync(&cfg->escan_timeout_work); brcmf_pno_detach(cfg); brcmf_btcoex_detach(cfg); wiphy_unregister(cfg->wiphy); -- 2.25.1

1 year, 3 months

1
0
0 0

[PATCH v2 1/2 RESEND] parport: parport_serial: Add Brainboxes BAR details

by Cameron Williams

Add BAR/enum entries for Brainboxes serial/parallel cards. Cc: stable(a)vger.kernel.org Signed-off-by: Cameron Williams <cang1(a)live.co.uk> --- Looks like this slipped through the grate the first time. Cc LKML and stable this time. v1 - v2: This is a re-submission for [1] which splits the changes into two patches. [1] https://lore.kernel.org/all/DU0PR02MB7899033E7E81EAF3694BC20AC4F8A@DU0PR02M… drivers/parport/parport_serial.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c index 9f5d784cd95d..11989368611a 100644 --- a/drivers/parport/parport_serial.c +++ b/drivers/parport/parport_serial.c @@ -65,6 +65,10 @@ enum parport_pc_pci_cards { sunix_5069a, sunix_5079a, sunix_5099a, + brainboxes_uc257, + brainboxes_is300, + brainboxes_uc414, + brainboxes_px263, }; /* each element directly indexed from enum list, above */ @@ -158,6 +162,10 @@ static struct parport_pc_pci cards[] = { /* sunix_5069a */ { 1, { { 1, 2 }, } }, /* sunix_5079a */ { 1, { { 1, 2 }, } }, /* sunix_5099a */ { 1, { { 1, 2 }, } }, + /* brainboxes_uc257 */ { 1, { { 3, -1 }, } }, + /* brainboxes_is300 */ { 1, { { 3, -1 }, } }, + /* brainboxes_uc414 */ { 1, { { 3, -1 }, } }, + /* brainboxes_px263 */ { 1, { { 3, -1 }, } }, }; static struct pci_device_id parport_serial_pci_tbl[] = { -- 2.42.0

1 year, 3 months

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2023