commit a8cc9e5fcb upstream.
The early error path in hdm_probe() can jump to err_free_mdev before
&mdev->dev has been initialized with device_initialize(). Calling
put_device(&mdev->dev) there triggers a device core WARN and ends up
invoking kref_put(&kobj->kref, kobject_release) on an uninitialized
kobject.
In this path the private struct was only kmalloc'ed and the intended
release is effectively kfree(mdev) anyway, so free it directly instead
of calling put_device() on an uninitialized device.
This removes the WARNING and fixes the pre-initialization error path.
Fixes: 97a6f772f3 ("drivers: most: add USB adapter driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Victoria Votokina <Victoria.Votokina@kaspersky.com>
Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4b12709026 upstream.
hdm_disconnect() calls most_deregister_interface(), which eventually
unregisters the MOST interface device with device_unregister(iface->dev).
If that drops the last reference, the device core may call release_mdev()
immediately while hdm_disconnect() is still executing.
The old code also freed several mdev-owned allocations in
hdm_disconnect() and then performed additional put_device() calls.
Depending on refcount order, this could lead to use-after-free or
double-free when release_mdev() ran (or when unregister paths also
performed puts).
Fix by moving the frees of mdev-owned allocations into release_mdev(),
so they happen exactly once when the device is truly released, and by
dropping the extra put_device() calls in hdm_disconnect() that are
redundant after device_unregister() and most_deregister_interface().
This addresses the KASAN slab-use-after-free reported by syzbot in
hdm_disconnect(). See report and stack traces in the bug link below.
Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761
Fixes: 97a6f772f3 ("drivers: most: add USB adapter driver")
Signed-off-by: Victoria Votokina <Victoria.Votokina@kaspersky.com>
Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull staging/IIO driver updates from Greg KH:
"Here is the big set of staging and IIO driver updates for 5.13-rc1.
Lots of little churn in here, and some larger churn as well. Major
things are:
- removal of wimax drivers, no one has this hardware anymore for this
failed "experiment".
- removal of the Google gasket driver, turns out no one wanted to
maintain it or cares about it anymore, so they asked for it to be
removed.
- comedi finally moves out of the staging directory into drivers/comedi
This is one of the oldest kernel subsystems around, being created
in the 2.0 kernel days, and was one of the first things added to
drivers/staging/ when that was created over 15 years ago.
It should have been moved out of staging a long time ago, it's well
maintained and used by loads of different devices in the real world
every day. Nice to see this finally happen.
- so many tiny coding style cleanups it's not funny.
Perfect storm of at least 2 different intern project application
deadlines combined to provide a huge number of new contributions in
this area from people learning how to do kernel development. Great
job to everyone involved here.
There's also the normal updates for IIO drivers with new IIO drivers
and updates all over that subsystem.
All of these have been in linux-next for a while with no reported
issues"
* tag 'staging-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (907 commits)
staging: octeon: Use 'for_each_child_of_node'
Staging: rtl8723bs: rtw_xmit: fixed tabbing issue
staging: rtl8188eu: remove unused function parameters
staging: rtl8188eu: cmdThread is a task_struct
staging: rtl8188eu: remove constant variable and dead code
staging: rtl8188eu: change bLeisurePs' type to bool
staging: rtl8723bs: remove empty #ifdef block
staging: rtl8723bs: remove unused DBG_871X_LEVEL macro declarations
staging: rtl8723bs: split too long line
staging: rtl8723bs: fix indentation in if block
staging: rtl8723bs: fix code indent issue
staging: rtl8723bs: replace DBG_871X_LEVEL logs with netdev_*()
staging: rtl8192e: indent statement properly
staging: rtl8723bs: Remove led_blink_hdl() and everything related
staging: comedi: move out of staging directory
staging: rtl8723bs: remove sdio_drv_priv structure
staging: rtl8723bs: remove unused argument in function
staging: rtl8723bs: remove DBG_871X_SEL_NL macro declaration
staging: rtl8723bs: replace DBG_871X_SEL_NL with netdev_dbg()
staging: rtl8723bs: fix indentation issue introduced by long line split
...
In the case where the pointer iface is null then the reporting of this
error will dereference iface when printing an error message causing which
is not ideal. Since the majority of callers to most_register_interface
report an error when -EINVAL is returned a simple fix is to just remove
the error message, I doubt it will be missed.
Addresses-Coverity: ("Dereference after null check")
Fixes: 57562a7241 ("Staging: most: add MOST driver's core module")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200624163957.11676-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
