Damian Muszynski 8a5a7611cc crypto: qat - resolve race condition during AER recovery ... [ Upstream commit 7d42e097607c4d246d99225bf2b195b6167a210c ] During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will exit due to a timeout, and the reset_data structure will be freed. However, this data structure is used for completion notification after the restart is completed, which leads to a UAF bug. This results in a KFENCE bug notice. BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat] Use-after-free read at 0x00000000bc56fddf (in kfence-#142): adf_device_reset_worker+0x38/0xa0 [intel_qat] process_one_work+0x173/0x340 To resolve this race condition, the memory associated to the container of the work_struct is freed on the worker if the timeout expired, otherwise on the function that schedules the worker. The timeout detection can be done by checking if the caller is still waiting for completion or not by using completion_done() function. Fixes: d8cba25d2c ("crypto: qat - Intel(R) QAT driver framework") Cc: <stable@vger.kernel.org> Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-03 15:28:19 +02:00
..
accel	accel/ivpu: Don't enable any tiles by default on VPU40xx	2024-03-01 13:35:01 +01:00
accessibility	…
acpi	ACPI: scan: Fix device check notification handling	2024-03-26 18:19:35 -04:00
amba	…
android	binder: signal epoll threads of self-work	2024-02-23 09:25:04 +01:00
ata	ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts	2024-03-01 13:35:11 +01:00
atm	atm: idt77252: fix a memleak in open_card_ubr0	2024-02-16 19:10:49 +01:00
auxdisplay	…
base	regmap: kunit: Ensure that changed bytes are actually different	2024-03-26 18:19:10 -04:00
bcma	…
block	aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts	2024-03-26 18:19:19 -04:00
bluetooth	Bluetooth: btusb: Fix memory leak	2024-03-26 18:19:38 -04:00
bus	bus: mhi: ep: check the correct variable in mhi_ep_register_controller()	2024-03-26 18:20:06 -04:00
cache	cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback()	2024-03-01 13:35:08 +01:00
cdrom	…
cdx	…
char	hwrng: starfive - Fix dev_err_probe return error	2024-02-05 20:14:16 +00:00
clk	clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd	2024-04-03 15:28:16 +02:00
clocksource	clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings	2024-01-25 15:35:42 -08:00
comedi	comedi: comedi_test: Prevent timers rescheduling during deletion	2024-03-26 18:20:04 -04:00
connector	connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared"	2024-02-23 09:25:01 +01:00
counter	…
cpufreq	cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()	2024-04-03 15:28:18 +02:00
cpuidle	cpuidle: haltpoll: Do not enable interrupts when entering idle	2024-01-25 15:35:15 -08:00
crypto	crypto: qat - resolve race condition during AER recovery	2024-04-03 15:28:19 +02:00
cxl	cxl/region: Allow out of order assembly of autodiscovered regions	2024-03-26 18:19:12 -04:00
dax	…
dca	…
devfreq	PM / devfreq: Synchronize devfreq_monitor_[start/stop]	2024-02-05 20:14:15 +00:00
dio	…
dma	dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA	2024-03-26 18:19:43 -04:00
dma-buf	dma-buf: fix check in dma_resv_add_fence	2023-12-08 08:52:19 +01:00
edac	EDAC/thunderx: Fix possible out-of-bounds string access	2024-01-25 15:35:12 -08:00
eisa	…
extcon	extcon: fix possible name leak in extcon_dev_register()	2024-02-05 20:14:31 +00:00
firewire	firewire: core: use long bus reset on gap count error	2024-03-26 18:19:14 -04:00
firmware	x86/efistub: Don't clear BSS twice in mixed mode	2024-03-26 18:20:13 -04:00
fpga	fpga: Fix memory leak for fpga_region_test_class_find()	2023-10-24 19:32:39 +02:00
fsi	…
gnss	…
gpio	gpiolib: Pass consumer device through to core in devm_fwnode_gpiod_get_index()	2024-03-26 18:19:34 -04:00
gpu	drm/vmwgfx: Fix the lifetime of the bo cursor memory	2024-04-03 15:28:16 +02:00
greybus	…
hid	HID: amd_sfh: Avoid disabling the interrupt	2024-03-26 18:19:53 -04:00
hsi	…
hte	hte: tegra: Fix missing error code in tegra_hte_test_probe()	2023-11-20 11:59:08 +01:00
hv	x86/hyperv: Use per cpu initial stack for vtl context	2024-03-26 18:20:06 -04:00
hwmon	hwmon: (nct6775) Fix access to temperature configuration registers	2024-03-01 13:35:08 +01:00
hwspinlock	…
hwtracing	hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()	2024-03-26 18:20:06 -04:00
i2c	i2c: imx: when being a target, mark the last read as processed	2024-03-01 13:35:10 +01:00
i3c	i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling	2024-03-26 18:20:01 -04:00
idle	x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram	2024-01-25 15:35:12 -08:00
iio	iio: gts-helper: Fix division loop	2024-03-26 18:20:05 -04:00
infiniband	RDMA/mana_ib: Fix bug in creation of dma regions	2024-03-26 18:20:02 -04:00
input	Input: iqs7222 - add support for IQS7222D v1.1 and v1.2	2024-03-26 18:20:02 -04:00
interconnect	interconnect: qcom: sm8550: Enable sync_state	2024-02-23 09:24:57 +01:00
iommu	iommu: Fix compilation without CONFIG_IOMMU_INTEL	2024-03-26 18:19:39 -04:00
ipack	…
irqchip	irqchip/sifive-plic: Enable interrupt if needed before EOI	2024-03-01 13:35:01 +01:00
isdn	isdn: mISDN: hfcsusb: Spelling fix in comment	2023-10-23 09:39:46 +01:00
leds	leds: sgm3140: Add missing timer cleanup and flash gpio control	2024-03-26 18:19:55 -04:00
macintosh	…
mailbox	mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt	2024-02-05 20:14:31 +00:00
mcb	mcb: fix error handling for different scenarios when parsing	2023-11-28 17:20:05 +00:00
md	dm-integrity: align the outgoing bio in integrity_recheck	2024-03-26 18:20:13 -04:00
media	media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT	2024-04-03 15:28:18 +02:00
memory	memory: tegra: Correct DLA client names	2024-03-26 18:19:32 -04:00
memstick	…
message	…
mfd	mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults	2024-03-26 18:19:55 -04:00
misc	mei: gsc_proxy: match component when GSC is on different bus	2024-03-26 18:20:04 -04:00
mmc	mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function	2024-03-26 18:19:36 -04:00
most	…
mtd	mtd: rawnand: lpc32xx_mlc: fix irq handler prototype	2024-03-26 18:19:52 -04:00
mux	…
net	wifi: brcmfmac: avoid invalid list operation when vendor attach fails	2024-04-03 15:28:15 +02:00
nfc	nfc: virtual_ncidev: Add variable to check if ndev is running	2023-12-20 17:01:59 +01:00
ntb	NTB: fix possible name leak in ntb_register_device()	2024-03-26 18:19:48 -04:00
nubus	…
nvdimm	nd_btt: Make BTT lanes preemptible	2023-11-20 11:59:19 +01:00
nvme	nvme: fix reconnection fail due to reserved tag allocation	2024-03-26 18:20:09 -04:00
nvmem	nvmem: brcm_nvram: store a copy of NVRAM content	2024-01-01 12:42:44 +00:00
of	of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing	2024-03-06 14:48:39 +00:00
opp	OPP: debugfs: Fix warning around icc_get_name()	2024-03-26 18:19:40 -04:00
parisc	parisc/power: Fix power soft-off button emulation on qemu	2024-01-31 16:18:52 -08:00
parport	parport: parport_serial: Add Brainboxes device IDs and geometry	2024-01-20 11:51:48 +01:00
pci	PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling	2024-03-26 18:19:56 -04:00
pcmcia	pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()	2023-11-20 11:59:31 +01:00
peci	…
perf	perf: RISCV: Fix panic on pmu overflow handler	2024-03-26 18:19:14 -04:00
phy	phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes	2024-03-06 14:48:43 +00:00
pinctrl	gpio: nomadik: fix offset bug in nmk_pmx_set()	2024-03-26 18:19:54 -04:00
platform	platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name	2024-03-26 18:19:12 -04:00
pmdomain	pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl	2024-03-26 18:19:23 -04:00
pnp	PNP: ACPI: fix fortify warning	2024-02-05 20:14:15 +00:00
power	power: supply: bq27xxx-i2c: Do not free non existing IRQ	2024-03-06 14:48:37 +00:00
powercap	powercap: intel_rapl_tpmi: Fix System Domain probing	2024-04-03 15:28:19 +02:00
pps	…
ps3	…
ptp	ptp: annotate data-race around q->head and q->tail	2023-11-28 17:19:51 +00:00
pwm	pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan	2024-03-26 18:19:27 -04:00
rapidio	…
ras	…
regulator	regulator: userspace-consumer: add module device table	2024-03-26 18:19:34 -04:00
remoteproc	remoteproc: virtio: Fix wdg cannot recovery remote processor	2024-04-03 15:28:16 +02:00
reset	reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning	2024-01-20 11:51:44 +01:00
rpmsg	rpmsg: virtio: Free driver_override when rpmsg_remove()	2024-01-31 16:18:50 -08:00
rtc	rtc: mt6397: select IRQ_DOMAIN instead of depending on it	2024-03-26 18:20:06 -04:00
s390	s390/dasd: fix double module refcount decrement	2024-03-26 18:19:17 -04:00
sbus	…
scsi	scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn	2024-03-26 18:20:01 -04:00
sh	…
siox	…
slimbus	…
soc	soc: fsl: dpio: fix kcalloc() argument order	2024-03-26 18:20:08 -04:00
soundwire	soundwire: fix initializing sysfs for same devices on different buses	2024-01-31 16:18:47 -08:00
spi	spi: spi-mt65xx: Fix NULL pointer access in interrupt handler	2024-03-26 18:20:13 -04:00
spmi	spmi: mediatek: Fix UAF on device remove	2024-02-05 20:14:32 +00:00
ssb	…
staging	media: staging: ipu3-imgu: Set fields before media_entity_pads_init()	2024-04-03 15:28:15 +02:00
target	scsi: target: pscsi: Fix bio_put() for error case	2024-03-01 13:34:59 +01:00
tc	…
tee	tee: optee: Fix supplicant based device enumeration	2023-12-13 18:45:11 +01:00
thermal	powercap: intel_rapl: Fix locking in TPMI RAPL	2024-04-03 15:28:19 +02:00
thunderbolt	thunderbolt: Fix setting the CNS bit in ROUTER_CS_5	2024-02-23 09:25:13 +01:00
tty	serial: max310x: fix NULL pointer dereference in I2C instantiation	2024-04-03 15:28:16 +02:00
ufs	scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare()	2024-03-01 13:34:55 +01:00
uio	uio: Fix use-after-free in uio_open	2024-01-20 11:51:48 +01:00
usb	usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin	2024-03-26 18:20:06 -04:00
vdpa	vdpa/mlx5: Allow CVQ size changes	2024-03-26 18:20:10 -04:00
vfio	iommufd/iova_bitmap: Consider page offset for the pages to be pinned	2024-03-01 13:35:05 +01:00
vhost	virtio/vsock: send credit update during setting SO_RCVLOWAT	2024-01-25 15:35:26 -08:00
video	backlight: lp8788: Fully initialize backlight_properties during probe	2024-03-26 18:19:56 -04:00
virt	virt: sevguest: Fix passing a stack buffer as a scatterlist target	2023-11-20 11:59:30 +01:00
virtio	virtio: packed: fix unmap leak for indirect desc table	2024-03-26 18:20:11 -04:00
vlynq	…
w1	…
watchdog	watchdog: stm32_iwdg: initialize default timeout	2024-03-26 18:20:02 -04:00
xen	xen/events: increment refcnt only if event channel is refcounted	2024-03-26 18:20:09 -04:00
zorro	…
Kconfig	…
Makefile	…