android_kernel_samsung_sm8650/drivers/message/fusion
Zheng Wang 9c6da3b7f1 scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
[ Upstream commit f486893288f3e9b171b836f43853a6426515d800 ]

mptlan_probe() calls mpt_register_lan_device() which initializes the
&priv->post_buckets_task workqueue. A call to
mpt_lan_wake_post_buckets_task() will subsequently start the work.

During driver unload in mptlan_remove() the following race may occur:

CPU0                  CPU1

                    |mpt_lan_post_receive_buckets_work()
mptlan_remove()     |
  free_netdev()     |
    kfree(dev);     |
                    |
                    | dev->mtu
                    |   //use

Fix this by finishing the work prior to cleaning up in mptlan_remove().

[mkp: we really should remove mptlan instead of attempting to fix it]

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Link: https://lore.kernel.org/r/20230318081635.796479-1-zyytlz.wz@163.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-24 17:32:37 +01:00
..
lsi scsi: message: mptlan: Replace one-element array with flexible-array member 2021-04-01 23:03:10 -04:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile
mptbase.c scsi: message: fusion: Remove redundant variable dmp 2022-04-06 22:28:07 -04:00
mptbase.h scsi: message: fusion: Remove unused mpt_pci driver .probe() 'id' parameter 2021-10-12 17:37:15 -05:00
mptctl.c scsi: message: fusion: Remove redundant variable iocnum 2022-08-31 23:39:57 -04:00
mptctl.h
mptdebug.h scsi: message: fusion: Avoid -Wempty-body warnings 2021-04-01 22:55:25 -04:00
mptfc.c scsi: message: fusion: Switch to attribute groups 2021-10-16 21:45:53 -04:00
mptlan.c scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition 2023-05-24 17:32:37 +01:00
mptlan.h scsi: fusion: fix if-statement empty body warning 2020-03-11 23:07:57 -04:00
mptsas.c scsi: message: fusion: Use GFP_KERNEL instead of GFP_ATOMIC in non-atomic context 2022-02-27 21:21:21 -05:00
mptsas.h scsi: message: fusion: Remove in_interrupt() usage in mptsas_cleanup_fw_event_q() 2020-12-01 00:03:54 -05:00
mptscsih.c scsi: message: fusion: Switch to attribute groups 2021-10-16 21:45:53 -04:00
mptscsih.h scsi: message: fusion: Switch to attribute groups 2021-10-16 21:45:53 -04:00
mptspi.c scsi: message: fusion: Drop redundant "the" 2022-06-21 21:34:52 -04:00