mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 04:04:43 +01:00
8930878101
When the PCA-200E or SBA-200E adapter is being detached, the fore200e
is deallocated. However, the tx_tasklet or rx_tasklet may still be running
or pending, leading to use-after-free bug when the already freed fore200e
is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
One of the race conditions can occur as follows:
CPU 0 (cleanup) | CPU 1 (tasklet)
fore200e_pca_remove_one() | fore200e_interrupt()
fore200e_shutdown() | tasklet_schedule()
kfree(fore200e) | fore200e_tx_tasklet()
| fore200e-> // UAF
Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
synchronize with any pending or running tasklets. Moreover, since
fore200e_reset() could prevent further interrupts or data transfers,
the tasklet_kill() should be placed after fore200e_reset() to prevent
the tasklet from being rescheduled in fore200e_interrupt(). Finally,
it only needs to do tasklet_kill() when the fore200e state is greater
than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
in earlier states. In a word, the tasklet_kill() should be placed in
the FORE200E_STATE_IRQ branch within the switch...case structure.
This bug was identified through static analysis.
Fixes:
|
||
|---|---|---|
| .. | ||
| .gitignore | ||
| adummy.c | ||
| atmtcp.c | ||
| eni.c | ||
| eni.h | ||
| fore200e.c | ||
| fore200e.h | ||
| he.c | ||
| he.h | ||
| idt77105.c | ||
| idt77105.h | ||
| idt77252.c | ||
| idt77252.h | ||
| idt77252_tables.h | ||
| iphase.c | ||
| iphase.h | ||
| Kconfig | ||
| lanai.c | ||
| Makefile | ||
| midway.h | ||
| nicstar.c | ||
| nicstar.h | ||
| nicstarmac.c | ||
| nicstarmac.copyright | ||
| solos-attrlist.c | ||
| solos-pci.c | ||
| suni.c | ||
| suni.h | ||
| tonga.h | ||
| zeprom.h | ||