averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
193d669c7a05c86f9636ab445dfb95bc69899ebd
linux-stable-mirror/drivers
T
History
Zhang TianciandGreg Kroah-Hartman 09723f26ed vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter 
commit ae9c13b6fd upstream.

There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:

vduse_dev_read_iter():
    lock(msg_lock);
    dequeue_msg(send_list);
    unlock(msg_lock);
vduse_dev_msg_sync():
    wait_timeout() finish
    lock(msg_lock);
    check msg->complete is false
        list_del(msg);   <- double list_del() crash!

To fix this case, we shall ensure vduse_msg is on send_list or recv_list
outside the msg_lock critical section.

Fixes: c8a6153b6c ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com>
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260226115550.1814-3-zhangtianci.1997@bytedance.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-24 15:54:57 +02:00
..
accessibility
…
acpi
ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
2026-07-24 15:54:50 +02:00
amba
…
android
binder: fix UAF in binder_free_transaction()
2026-07-24 15:54:21 +02:00
ata
ata: sata_gemini: unwind clocks on IDE pinctrl errors
2026-07-24 15:54:55 +02:00
atm
…
auxdisplay
auxdisplay: line-display: fix OOB read on zero-length message_store()
2026-06-19 13:36:59 +02:00
base
firmware_loader: Fix recursive lock in device_cache_fw_images()
2026-07-24 15:54:40 +02:00
bcma
…
block
drbd: Balance RCU calls in drbd_adm_dump_devices()
2026-06-01 17:39:04 +02:00
bluetooth
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
2026-07-24 15:54:56 +02:00
bus
bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
2026-07-24 15:54:45 +02:00
cdrom
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
2026-06-01 17:39:27 +02:00
char
char: tlclk: fix use-after-free in tlclk_cleanup()
2026-07-24 15:54:45 +02:00
clk
clk: qcom: a53: Corrected frequency multiplier for 1152MHz
2026-07-24 15:54:46 +02:00
clocksource
clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
2026-07-24 15:54:24 +02:00
comedi
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
2026-06-19 13:37:03 +02:00
connector
…
counter
counter: Fix refcount leak in counter_alloc() error path
2026-06-19 13:37:03 +02:00
cpufreq
cpufreq: conservative: Simplify frequency limit handling
2026-07-24 15:54:35 +02:00
cpuidle
cpuidle: powerpc: avoid double clear when breaking snooze
2026-06-01 17:38:57 +02:00
crypto
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
2026-07-24 15:54:42 +02:00
cxl
…
dax
dax/kmem: account for partial discontiguous resource upon removal
2026-07-24 15:54:37 +02:00
dca
…
devfreq
…
dio
…
dma
dmaengine: Fix possible use after free
2026-07-24 15:54:46 +02:00
dma-buf
udmabuf: fix DMA direction mismatch in release_udmabuf()
2026-07-24 15:54:29 +02:00
edac
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
2026-07-24 15:54:37 +02:00
eisa
…
extcon
extcon: ptn5150: handle pending IRQ events during system resume
2026-06-01 17:38:56 +02:00
firewire
…
firmware
firmware: arm_scmi: Fix OOB in scmi_power_name_get()
2026-07-24 15:54:35 +02:00
fpga
fpga: region: fix use-after-free in child_regions_with_firmware()
2026-07-04 13:41:32 +02:00
fsi
…
gnss
…
gpio
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
2026-07-24 15:54:54 +02:00
gpu
drm/edid: fix OOB read in drm_parse_tiled_block()
2026-07-24 15:54:51 +02:00
greybus
…
hid
HID: core: Fix OOB read in hid_get_report for numbered reports
2026-07-24 15:54:55 +02:00
hsi
…
hte
…
hv
Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
2026-07-04 13:41:33 +02:00
hwmon
hwmon: adm1275: Prevent reading uninitialized stack
2026-07-24 15:54:54 +02:00
hwspinlock
hwspinlock: qcom: avoid uninitialized struct members
2026-07-24 15:54:40 +02:00
hwtracing
coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
2026-07-24 15:54:44 +02:00
i2c
i2c: stm32f7: truncate clock period instead of rounding it
2026-07-24 15:54:29 +02:00
i3c
i3c: master: Prevent reuse of dynamic address on device add failure
2026-07-24 15:54:48 +02:00
idle
…
iio
iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
2026-07-24 15:54:45 +02:00
infiniband
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
2026-07-24 15:54:41 +02:00
input
Input: maplecontrol - set driver data before registering input device
2026-07-24 15:54:30 +02:00
interconnect
…
iommu
iommu/amd: Fix a stale comment about which legacy mode is user visible
2026-07-24 15:54:34 +02:00
ipack
…
irqchip
irqchip/ts4800: Fix missing chained handler cleanup on remove
2026-07-24 15:54:54 +02:00
isdn
…
leds
leds: lgm-sso: Remove duplicate assignments for priv->mmap
2026-06-01 17:39:19 +02:00
macintosh
…
mailbox
mailbox: mtk-adsp: fix UAF during device teardown
2026-07-24 15:54:45 +02:00
mcb
…
md
dm era: fix NULL pointer dereference in metadata_open()
2026-07-24 15:54:57 +02:00
media
media: qcom: venus: relax encoder frame/blur step size on v6
2026-07-24 15:54:37 +02:00
memory
memory: tegra30-emc: Fix dll_change check
2026-06-01 17:39:15 +02:00
memstick
…
message
…
mfd
mfd: cros_ec: Delay dev_set_drvdata() until probe success
2026-07-24 15:54:23 +02:00
misc
misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
2026-07-04 13:41:33 +02:00
mmc
mmc: sdhci: add signal voltage switch in sdhci_resume_host
2026-06-19 13:37:16 +02:00
most
…
mtd
mtd: spi-nor: Drop duplicate Kconfig dependency
2026-07-24 15:54:36 +02:00
mux
…
net
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
2026-07-24 15:54:57 +02:00
nfc
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
2026-06-19 13:36:53 +02:00
ntb
NTB: epf: Fix doorbell bitmask and IRQ vector handling
2026-07-24 15:54:52 +02:00
nubus
…
nvdimm
nvdimm/btt: Handle preemption in BTT lane acquisition
2026-07-24 15:54:38 +02:00
nvme
nvme-multipath: fix flex array size in struct nvme_ns_head
2026-07-24 15:54:36 +02:00
nvmem
…
of
…
opp
…
parisc
parisc: Fix IRQ leak in LASI driver
2026-06-01 17:38:56 +02:00
parport
parport: Fix race between port and client registration
2026-06-19 13:37:00 +02:00
pci
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
2026-07-24 15:54:51 +02:00
pcmcia
PCMCIA: Fix garbled log messages for KERN_CONT
2026-06-01 17:39:22 +02:00
peci
…
perf
…
phy
phy: phy-can-transceiver: Check driver match and driver data against NULL
2026-07-24 15:54:45 +02:00
pinctrl
pinctrl: meson: restore non-sleeping GPIO access
2026-07-24 15:54:54 +02:00
platform
platform/x86: xo15-ebook: Fix wakeup source and GPE handling
2026-07-24 15:54:45 +02:00
pnp
…
power
power: supply: core: fix supplied_from allocations
2026-07-24 15:54:43 +02:00
powercap
…
pps
…
ps3
…
ptp
ptp: vclock: Switch from RCU to SRCU
2026-06-19 13:37:09 +02:00
pwm
pwm: imx27: Fix variable truncation in .apply()
2026-07-24 15:54:35 +02:00
rapidio
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
2026-07-24 15:54:37 +02:00
ras
…
regulator
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
2026-07-24 15:54:57 +02:00
remoteproc
…
reset
…
rpmsg
rpmsg: char: Fix use-after-free on probe error path
2026-07-24 15:54:17 +02:00
rtc
rtc: cmos: unregister HPET IRQ handler on probe failure
2026-07-24 15:54:53 +02:00
s390
Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()"
2026-06-01 17:39:34 +02:00
sbus
…
scsi
scsi: pm8001: Fix error code in non_fatal_log_show()
2026-07-24 15:54:38 +02:00
sh
…
siox
…
slimbus
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
2026-07-24 15:54:16 +02:00
soc
soc: qcom: aoss: compare against normalized cooling state
2026-06-01 17:39:16 +02:00
soundwire
soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
2026-06-01 17:39:16 +02:00
spi
spi: sh-msiof: abort transfers when reset times out
2026-07-24 15:54:53 +02:00
spmi
…
ssb
…
staging
staging: most: video: avoid double free on video register failure
2026-07-24 15:54:45 +02:00
target
scsi: target: Fix hexadecimal CHAP_I handling
2026-07-24 15:54:40 +02:00
tc
…
tee
tee: optee: prevent use-after-free when the client exits before the supplicant
2026-06-19 13:37:08 +02:00
thermal
thermal: intel: Fix dangling resources on thermal_throttle_online() failure
2026-07-24 15:54:49 +02:00
thunderbolt
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
2026-06-19 13:37:29 +02:00
tty
serial: 8250_omap: clear rx_running on zero-length DMA completes
2026-07-24 15:54:32 +02:00
ufs
…
uio
…
usb
usb: host: max3421: Reject hub port requests for non-existent ports
2026-07-24 15:54:45 +02:00
vdpa
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
2026-07-24 15:54:57 +02:00
vfio
vfio/pci: Release the VGA arbiter client on register_device() failure
2026-07-24 15:54:20 +02:00
vhost
vhost/net: complete zerocopy ubufs only once
2026-07-24 15:54:41 +02:00
video
fbdev: sm501fb: Fix buffer errors in OF binding code
2026-07-24 15:54:40 +02:00
virt
…
virtio
virtio_ring: introduce dma sync api for virtqueue
2026-07-24 15:54:49 +02:00
vlynq
…
w1
…
watchdog
watchdog: unregister PM notifier on watchdog unregister
2026-07-24 15:54:40 +02:00
xen
…
zorro
…
Kconfig
…
Makefile
…