kernel.git/drivers/hsi/clients, branch linux-5.4.y

HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

2025-05-02T05:39:18Z

commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream. In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove(). Signed-off-by: Kaixin Wang Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman

Merge tag 'hsi-for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi

2019-09-22T19:02:21Z

Pull HSI updates from Sebastian Reichel: "Misc cleanups" * tag 'hsi-for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: Remove dev_err() usage after platform_get_irq() HSI: ssi_protocol: Mark expected switch fall-throughs

net: Use skb_frag_off accessors

2019-07-30T21:21:32Z

Use accessor functions for skb fragment's page_offset instead of direct references, in preparation for bvec conversion. Signed-off-by: Jonathan Lemon Signed-off-by: David S. Miller

HSI: ssi_protocol: Mark expected switch fall-throughs

2019-07-30T19:26:24Z

Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: arm): drivers/hsi/clients/ssi_protocol.c: In function ‘ssip_set_rxstate’: drivers/hsi/clients/ssi_protocol.c:291:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (atomic_read(&ssi->tx_usecnt)) ^ drivers/hsi/clients/ssi_protocol.c:294:2: note: here case RECEIVING: ^~~~ drivers/hsi/clients/ssi_protocol.c: In function ‘ssip_keep_alive’: drivers/hsi/clients/ssi_protocol.c:466:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (atomic_read(&ssi->tx_usecnt) == 0) ^ drivers/hsi/clients/ssi_protocol.c:472:3: note: here case SEND_IDLE: ^~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Sebastian Reichel

net: Use skb accessors in network drivers

2019-07-23T03:47:56Z

In preparation for unifying the skb_frag and bio_vec, use the fine accessors which already exist and use skb_frag_t instead of struct skb_frag_struct. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: David S. Miller

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336

2019-06-05T15:37:07Z

Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 51 franklin st fifth floor boston ma 02110 1301 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 246 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Alexios Zavras Reviewed-by: Allison Randal Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190530000436.674189849@linutronix.de Signed-off-by: Greg Kroah-Hartman

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21T08:50:46Z

Add SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any form These files fall under the project license, GPL v2 only. The resulting SPDX license identifier is: GPL-2.0-only Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman

hsi: clients: Change return type to vm_fault_t

2018-04-17T14:05:26Z

Use new return type vm_fault_t for fault handler. For now, this is just documenting that the function returns a VM_FAULT value rather than an errno. Once all instances are converted, vm_fault_t will become a distinct type. Reference id -> 1c8f422059ae ("mm: change return type to vm_fault_t") Signed-off-by: Souptick Joarder Signed-off-by: Sebastian Reichel

HSI: hsi_char: Delete an error message for a failed memory allocation in hsc_probe()

2018-03-19T15:31:07Z

Omit an extra message for a memory allocation failure in this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Sebastian Reichel

HSI: ssi_protocol: fix spelling mistake: "trigerred" -> "triggered"

2018-03-19T15:31:07Z

Trivial fix to spelling mistake in dev_err error message text. Signed-off-by: Colin Ian King Signed-off-by: Sebastian Reichel