Zou Wei
ca96b8ea5e
watchdog: Fix possible use-after-free by calling del_timer_sync() ...
[ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ]
This driver's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Vladimir Zapolskiy <vz@mleia.com>
Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-20 16:21:13 +02:00
ACPI: sysfs: Fix a buffer overrun problem with description_show()
2021-07-20 16:21:01 +02:00
amba: Fix resource leak for drivers without .remove
2021-03-03 17:44:38 +01:00
binder: Prevent context manager from incrementing ref 0
2020-08-21 11:01:55 +02:00
ata: ahci_sunxi: Disable DIPM
2021-07-20 16:21:09 +02:00
atm: nicstar: register the interrupt handler in the right place
2021-07-20 16:21:08 +02:00
Revert "device property: Keep secondary firmware node secondary by type"
2021-01-12 19:49:05 +01:00
xen-blkback: don't leak persistent grants from xen_blkbk_map()
2021-03-30 14:41:43 +02:00
Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
2021-07-20 16:21:08 +02:00
bus: qcom: Put child node before return
2021-05-22 10:40:23 +02:00
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:29:07 +02:00
ipmi/watchdog: Stop watchdog timer when the current action is 'none'
2021-07-20 16:21:09 +02:00
clk: tegra: Ensure that PLLU configuration is applied properly
2021-07-20 16:21:06 +02:00
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
2021-03-03 17:44:37 +01:00
cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get()
2021-01-17 13:57:54 +01:00
cpuidle: Fix three reference count leaks
2020-06-20 10:24:18 +02:00
crypto: nx - Fix RCU warning in nx842_OF_upd_status
2021-07-20 16:21:01 +02:00
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 20:40:02 +02:00
dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
2021-06-30 08:49:17 -04:00
EDAC/i5100: Fix error handling order in i5100_init_one()
2020-10-29 09:05:32 +01:00
extcon: max8997: Add missing modalias string
2021-07-20 16:21:05 +02:00
firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
2021-04-07 12:05:40 +02:00
qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
2021-07-20 16:21:09 +02:00
gpio: zynq: Check return value of pm_runtime_get_sync
2021-07-20 16:21:12 +02:00
drm/virtio: Fix double free on probe failure
2021-07-20 16:21:06 +02:00
HID: gt683r: add missing MODULE_DEVICE_TABLE
2021-06-30 08:49:11 -04:00
HSI: core: fix resource leaks in hsi_add_client_from_dt()
2021-05-22 10:40:26 +02:00
Drivers: hv: vmbus: Increase wait time for VMbus unload
2021-05-22 10:40:24 +02:00
hwmon: (max31790) Fix fan speed reporting for fan7..12
2021-07-20 16:21:01 +02:00
intel_th: Consistency and off-by-one fix
2021-05-22 10:40:16 +02:00
i2c: core: Disable client irq on reboot/shutdown
2021-07-20 16:21:12 +02:00
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
2021-07-20 16:21:04 +02:00
RDMA/cma: Fix rdma_resolve_route() memory leak
2021-07-20 16:21:08 +02:00
Input: hil_kbd - fix error return code in hil_dev_connect()
2021-07-20 16:21:04 +02:00
iommu/amd: Fix sleeping in atomic in increase_address_space()
2021-03-11 13:48:03 +01:00
ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
2021-07-20 16:21:10 +02:00
irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
2020-12-29 13:45:00 +01:00
mISDN: fix possible use-after-free in HFC_cleanup()
2021-07-20 16:21:06 +02:00
leds: ktd2692: Fix an error handling path
2021-07-20 16:21:05 +02:00
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-20 10:24:21 +02:00
dm btree remove: assign new_root only when removal succeeds
2021-07-20 16:21:10 +02:00
media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
2021-07-20 16:21:10 +02:00
memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
2021-05-22 10:40:22 +02:00
memstick: r592: Fix error return in r592_probe()
2020-12-29 13:44:58 +01:00
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-10 10:23:57 +01:00
mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE
2021-07-20 16:21:11 +02:00
misc/libmasm/module: Fix two use after free in ibmasm_init_one
2021-07-20 16:21:11 +02:00
mmc: core: clear flags before allowing to retune
2021-07-20 16:21:09 +02:00
mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
2021-05-22 10:40:24 +02:00
sfc: error code if SRIOV cannot be disabled
2021-07-20 16:21:08 +02:00
nfc: pn533: prevent potential memory corruption
2021-05-22 10:40:26 +02:00
NTB: hw: amd: fix an issue about leak system resources
2020-10-29 09:05:41 +01:00
libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-03 17:44:44 +01:00
nvmet: don't check iosqes,iocqes for discovery controllers
2021-03-24 10:59:23 +01:00
nvmem: qfprom: remove incorrect write support
2020-06-11 09:22:22 +02:00
of: Fix truncation of memory sizes on 32-bit platforms
2021-07-20 16:21:05 +02:00
parisc: mask out enable and reserved bits from sba imask
2020-08-21 11:02:06 +02:00
Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
2021-06-30 08:49:19 -04:00
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
2021-07-20 16:21:05 +02:00
pinctrl/amd: Add device HID for new AMD GPIO controller
2021-07-20 16:21:09 +02:00
platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard()
2021-07-20 16:21:00 +02:00
power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE
2021-07-20 16:21:13 +02:00
powercap: restrict energy meter to root access
2020-11-10 21:04:57 +01:00
powerpc/ps3: use dma_mapping_error()
2020-12-29 13:45:00 +01:00
ptp: free ptp device pin descriptors properly
2020-05-20 08:15:33 +02:00
pwm: spear: Don't modify HW state in .remove callback
2021-07-20 16:21:13 +02:00
rapidio: handle create_workqueue() failure
2021-05-26 11:29:06 +02:00
regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
2021-07-20 16:20:59 +02:00
remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
2021-02-23 13:59:14 +01:00
rtc: rx8010: don't modify the global rtc ops
2020-11-10 10:23:59 +01:00
s390/sclp_vt220: fix console name to match device
2021-07-20 16:21:11 +02:00
scsi: iscsi: Add iscsi_cls_conn refcount helpers
2021-07-20 16:21:11 +02:00
soc/fsl: qbman: fix conflicting alignment attributes
2021-04-16 11:59:08 +02:00
spi: spi-sun6i: Fix chipselect/clock bug
2021-07-20 16:21:01 +02:00
ssb: sdio: Don't overwrite const buffer if block_write fails
2021-07-20 16:20:57 +02:00
staging: gdm724x: check for overflow in gdm_lte_netif_rx()
2021-07-20 16:21:05 +02:00
scsi: target: core: Fix warning on realtime kernels
2021-06-30 08:49:11 -04:00
thermal/core/fair share: Lock the thermal zone while looping over instances
2021-05-22 10:40:33 +02:00
tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
2021-07-20 16:21:11 +02:00
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb: gadget: hid: fix error return code in hid_bind()
2021-07-20 16:21:12 +02:00
vfio/platform: fix module_put call in error flow
2021-06-10 12:42:35 +02:00
vhost: Fix vhost_vq_reset()
2021-04-07 12:05:39 +02:00
backlight: lm3630a: Fix return code of .update_status() callback
2021-07-20 16:21:12 +02:00
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:05:35 +01:00
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:29:05 +02:00
w1: mxc_w1: Fix timeout resolution problem leading to bus error
2020-11-10 10:23:57 +01:00
watchdog: Fix possible use-after-free by calling del_timer_sync()
2021-07-20 16:21:13 +02:00
xen/events: reset active flag for lateeoi events later
2021-07-11 12:46:41 +02:00
ca96b8ea5e