mirror of
https://github.com/torvalds/linux.git
synced 2026-05-12 16:18:45 +02:00
db57a1aa54
RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
(kthread_stop) when killing a kthread. Generally, kthread_stop() is called
first, and in this case, no particular issues occur.
However, in rare instances where kthread_complete_and_exit() is called
first and then kthread_stop() is called, a UAF occurs because the kthread
object, which has already exited and been freed, is accessed again.
Therefore, to prevent this with minimal modification, you must remove
kthread_stop() and change the code to wait until the self-exit operation
is completed.
Cc: <stable@vger.kernel.org>
Reported-by: syzbot+5de83f57cd8531f55596@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69e5d03b.a00a0220.1bd0ca.0064.GAE@google.com/
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| rsi_91x_coex.c | ||
| rsi_91x_core.c | ||
| rsi_91x_debugfs.c | ||
| rsi_91x_hal.c | ||
| rsi_91x_mac80211.c | ||
| rsi_91x_main.c | ||
| rsi_91x_mgmt.c | ||
| rsi_91x_ps.c | ||
| rsi_91x_sdio_ops.c | ||
| rsi_91x_sdio.c | ||
| rsi_91x_usb_ops.c | ||
| rsi_91x_usb.c | ||
| rsi_boot_params.h | ||
| rsi_coex.h | ||
| rsi_common.h | ||
| rsi_debugfs.h | ||
| rsi_hal.h | ||
| rsi_main.h | ||
| rsi_mgmt.h | ||
| rsi_ps.h | ||
| rsi_sdio.h | ||
| rsi_usb.h | ||