Kaixin Wang ea0256e393 i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition ... [ Upstream commit 609366e7a0 ] In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. And cdns_i3c_master_interrupt can call cnds_i3c_master_demux_ibis function to start the work. If we remove the module which will call cdns_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | cdns_i3c_master_hj cdns_i3c_master_remove | i3c_master_unregister(&master->base) | device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in cdns_i3c_master_remove. Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn> Link: https://lore.kernel.org/r/20240911153544.848398-1-kxwang23@m.fudan.edu.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-10-17 15:24:17 +02:00
..
master	i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition	2024-10-17 15:24:17 +02:00
Kconfig	…
Makefile	…
device.c	driver core: make struct device_type.uevent() take a const *	2023-01-27 13:45:36 +01:00
internals.h	i3c: export SETDASA method	2022-12-11 21:25:58 +01:00
master.c	i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs	2023-11-20 11:59:29 +01:00