github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
4ce247af3f
linux/drivers
History
Daehwan Jung 4ce247af3f usb: gadget: rndis: add spinlock for rndis response list 
commit aaaba1c86d upstream.

There's no lock for rndis response list. It could cause list corruption
if there're two different list_add at the same time like below.
It's better to add in rndis_add_response / rndis_free_response
/ rndis_get_next_response to prevent any race condition on response list.

[  361.894299] [1:   irq/191-dwc3:16979] list_add corruption.
next->prev should be prev (ffffff80651764d0),
but was ffffff883dc36f80. (next=ffffff80651764d0).

[  361.904380] [1:   irq/191-dwc3:16979] Call trace:
[  361.904391] [1:   irq/191-dwc3:16979]  __list_add_valid+0x74/0x90
[  361.904401] [1:   irq/191-dwc3:16979]  rndis_msg_parser+0x168/0x8c0
[  361.904409] [1:   irq/191-dwc3:16979]  rndis_command_complete+0x24/0x84
[  361.904417] [1:   irq/191-dwc3:16979]  usb_gadget_giveback_request+0x20/0xe4
[  361.904426] [1:   irq/191-dwc3:16979]  dwc3_gadget_giveback+0x44/0x60
[  361.904434] [1:   irq/191-dwc3:16979]  dwc3_ep0_complete_data+0x1e8/0x3a0
[  361.904442] [1:   irq/191-dwc3:16979]  dwc3_ep0_interrupt+0x29c/0x3dc
[  361.904450] [1:   irq/191-dwc3:16979]  dwc3_process_event_entry+0x78/0x6cc
[  361.904457] [1:   irq/191-dwc3:16979]  dwc3_process_event_buf+0xa0/0x1ec
[  361.904465] [1:   irq/191-dwc3:16979]  dwc3_thread_interrupt+0x34/0x5c

Fixes: f6281af9d6 ("usb: gadget: rndis: use list_for_each_entry_safe")
Cc: stable <stable@kernel.org>
Signed-off-by: Daehwan Jung <dh10.jung@samsung.com>
Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-02 11:42:54 +01:00
..
accessibility speakup-dectlk: Restore pitch setting 2022-02-16 12:54:30 +01:00
acpi ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE 2022-02-16 12:54:24 +01:00
amba ARM: 9120/1: Revert "amba: make use of -1 IRQs warn" 2021-11-06 14:10:09 +01:00
android binder: fix handling of error during copy 2022-01-27 10:54:06 +01:00
ata ata: pata_hpt37x: disable primary channel on HPT371 2022-03-02 11:42:54 +01:00
atm
auxdisplay auxdisplay: ht16k33: Fix frame buffer device blanking 2021-11-18 14:04:24 +01:00
base regmap-irq: Update interrupt clear register for proper reset 2022-03-02 11:42:52 +01:00
bcma bcma: Fix memory leak for internally-handled cores 2021-09-15 09:50:45 +02:00
block floppy: Add max size check for user space request 2022-01-27 10:54:14 +01:00
bluetooth Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES 2022-01-27 10:54:18 +01:00
bus Revert "drivers: bus: simple-pm-bus: Add support for probing simple bus only devices" 2022-02-05 12:37:55 +01:00
cdrom
char random: wake up /dev/random writers after zap 2022-02-23 12:01:00 +01:00
clk clk: jz4725b: fix mmc0 clock gating 2022-03-02 11:42:46 +01:00
clocksource ARM: dts: Fix timer regression for beagleboard revision c 2022-02-16 12:54:22 +01:00
connector
counter counter: stm32-lptimer-cnt: remove iio counter abi 2022-01-27 10:54:08 +01:00
cpufreq cpufreq: Fix initialization of min and max frequency QoS requests 2022-01-27 10:54:17 +01:00
cpuidle cpuidle: Fix kobject memory leaks in error paths 2021-11-18 14:04:05 +01:00
crypto crypto: caam - replace this_cpu_ptr with raw_cpu_ptr 2022-01-27 10:54:24 +01:00
dax
dca
devfreq
dio
dma dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size 2022-02-23 12:01:07 +01:00
dma-buf dma-buf: heaps: Fix potential spectre v1 gadget 2022-02-08 18:30:36 +01:00
edac EDAC: Fix calculation of returned address and next offset in edac_align_ptr() 2022-02-23 12:01:07 +01:00
eisa
extcon
firewire
firmware efi/libstub: arm64: Fix image check alignment at entry 2022-02-01 17:25:46 +01:00
fpga fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 2021-09-30 10:11:04 +02:00
fsi fsi: Add missing MODULE_DEVICE_TABLE 2021-07-20 16:05:42 +02:00
gnss
gpio gpio: sifive: use the correct register to read output values 2022-02-16 12:54:24 +01:00
gpu drm/edid: Always set RGB444 2022-03-02 11:42:50 +01:00
greybus
hid HID:Add support for UGTABLET WP5540 2022-02-23 12:00:57 +01:00
hsi HSI: core: Fix return freed object in hsi_new_client 2022-01-27 10:54:12 +01:00
hv Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj 2022-02-23 12:01:04 +01:00
hwmon hwmon: Handle failure to register sensor with thermal zone correctly 2022-03-02 11:42:48 +01:00
hwspinlock
hwtracing coresight: cti: Correct the parameter for pm_runtime_put 2021-11-18 14:03:51 +01:00
i2c i2c: brcmstb: fix support for DSL and CM variants 2022-02-23 12:01:08 +01:00
i3c
ide
idle
iio iio: Fix error handling for PM 2022-03-02 11:42:53 +01:00
infiniband RDMA/ib_srp: Fix a deadlock 2022-03-02 11:42:53 +01:00
input Input: zinitix - make sure the IRQ is allocated before it gets enabled 2022-01-11 15:25:02 +01:00
interconnect treewide: Change list_sort to use const pointers 2021-09-30 10:11:04 +02:00
iommu iommu: Fix potential use-after-free during probe 2022-02-16 12:54:31 +01:00
ipack ipack: ipoctal: fix module reference leak 2021-10-06 15:56:01 +02:00
irqchip irqchip/sifive-plic: Add missing thead,c900-plic match string 2022-02-23 12:01:05 +01:00
isdn mISDN: change function names to avoid conflicts 2022-01-11 15:25:02 +01:00
leds leds: trigger: audio: Add an activate callback to ensure the initial brightness is set 2021-09-15 09:50:36 +02:00
lightnvm
macintosh
mailbox soc: mediatek: cmdq: add address shift in jump 2021-09-18 13:40:16 +02:00
mcb mcb: fix error handling in mcb_alloc_bus() 2021-09-30 10:11:00 +02:00
md dm: fix alloc_dax error handling in alloc_dev 2022-01-27 10:54:22 +01:00
media media: venus: core: Drop second v4l2 device unregister 2022-02-01 17:25:38 +01:00
memory memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails 2022-01-27 10:53:48 +01:00
memstick memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() 2021-11-18 14:04:07 +01:00
message
mfd mfd: atmel-flexcom: Use .resume_noirq 2022-01-27 10:53:51 +01:00
misc eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX 2022-02-16 12:54:27 +01:00
mmc mmc: block: fix read single on recovery logic 2022-02-23 12:00:57 +01:00
most most: fix control-message timeouts 2021-11-18 14:03:51 +01:00
mtd mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status 2022-02-23 12:01:04 +01:00
mux
net net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets 2022-03-02 11:42:51 +01:00
nfc NFC: st21nfca: Fix memory leak in device probe and remove 2022-01-05 12:40:31 +01:00
ntb NTB: perf: Fix an error code in perf_setup_inbuf() 2021-09-22 12:28:02 +02:00
nubus
nvdimm libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind 2021-09-18 13:40:36 +02:00
nvme nvme-rdma: fix possible use-after-free in transport error_recovery work 2022-02-23 12:01:00 +01:00
nvmem nvmem: core: set size for sysfs bin file 2022-01-27 10:54:22 +01:00
of of: base: Improve argument length mismatch error 2022-01-27 10:54:28 +01:00
opp opp: Fix return in _opp_add_static_v2() 2021-11-18 14:04:22 +01:00
oprofile
parisc parisc: Fix sglist access in ccio-dma.c 2022-02-23 12:00:57 +01:00
parport parport: remove non-zero check on count 2021-09-18 13:40:34 +02:00
pci PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology 2022-02-23 12:00:57 +01:00
pcmcia pcmcia: fix setting of kthread task states 2022-01-27 10:54:03 +01:00
perf
phy phy: usb: Leave some clocks running during suspend 2022-02-23 12:01:05 +01:00
pinctrl pinctrl: bcm2835: Fix a few error paths 2022-02-08 18:30:39 +01:00
platform surface: surface3_power: Fix battery readings on batteries without a serial number 2022-03-02 11:42:51 +01:00
pnp
power power: reset: mt6397: Check for null res pointer 2022-01-27 10:54:00 +01:00
powercap
pps
ps3
ptp ptp_pch: Load module automatically if ID matches 2021-10-13 10:04:27 +02:00
pwm pwm: stm32-lp: Don't modify HW state in .remove() callback 2021-09-26 14:09:01 +02:00
rapidio
ras
regulator regulator: qcom_smd: Align probe function with rpmh-regulator 2022-01-27 10:54:20 +01:00
remoteproc remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided 2022-01-20 09:17:50 +01:00
reset reset: socfpga: add empty driver allowing consumers to probe 2021-11-18 14:03:42 +01:00
rpmsg rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev 2022-02-01 17:25:43 +01:00
rtc rtc: cmos: Evaluate century appropriate 2022-02-08 18:30:39 +01:00
s390 scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices 2022-02-01 17:25:39 +01:00
sbus
scsi scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop 2022-02-23 12:01:07 +01:00
sfi
sh maple: fix wrong return value of maple_bus_init(). 2021-11-26 10:39:12 +01:00
siox
slimbus slimbus: ngd: reset dma setup during runtime pm 2021-08-26 08:35:55 -04:00
soc soc: aspeed: lpc-ctrl: Block error printing on probe defer cases 2022-02-23 12:01:06 +01:00
soundwire soundwire: debugfs: use controller id and link_id for debugfs 2021-11-18 14:04:16 +01:00
spi spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() 2022-03-02 11:42:52 +01:00
spmi
ssb
staging staging: fbtft: Fix error path in fbtft_driver_module_init() 2022-02-16 12:54:23 +01:00
target scsi: target: iscsi: Make sure the np under each tpg is unique 2022-02-16 12:54:19 +01:00
tc
tee optee: use driver internal tee_context for some rpc 2022-03-02 11:42:47 +01:00
thermal thermal/drivers/imx8mm: Enable ADC when enabling monitor 2022-01-27 10:53:52 +01:00
thunderbolt thunderbolt: Runtime PM activate both ends of the device link 2022-01-27 10:54:14 +01:00
tty sc16is7xx: Fix for incorrect data being transmitted 2022-03-02 11:42:53 +01:00
uio
usb usb: gadget: rndis: add spinlock for rndis response list 2022-03-02 11:42:54 +01:00
vdpa vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 2022-01-27 10:54:33 +01:00
vfio vfio: Use config not menuconfig for VFIO_NOIOMMU 2021-09-18 13:40:12 +02:00
vhost vhost/vsock: don't check owner in vhost_vsock_stop() while releasing 2022-03-02 11:42:46 +01:00
video fbcon: Add option to enable legacy hardware acceleration 2022-02-08 18:30:40 +01:00
virt
virtio virtio_ring: mark ring unused on error 2022-01-27 10:54:33 +01:00
visorbus
vlynq
vme
w1 w1: Misuse of get_user()/put_user() reported by sparse 2022-01-27 10:54:22 +01:00
watchdog ar7: fix kernel builds for compiler test 2021-11-18 14:04:24 +01:00
xen xen/gntdev: fix unmap notification order 2022-01-27 10:54:24 +01:00
zorro
Kconfig
Makefile