averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-25 16:19:48 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
bbda96e97a00a7f28ea57d0bcb7b56c29b22d442
linux-stable-mirror/drivers/scsi
T
History
Junrui LuoandGreg Kroah-Hartman e354793a7a scsi: aic94xx: fix use-after-free in device removal path 
commit f6ab594672 upstream.

The asd_pci_remove() function fails to synchronize with pending tasklets
before freeing the asd_ha structure, leading to a potential
use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload),
race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure,
ensuring all scheduled tasklets complete before cleanup proceeds.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 2908d778ab ("[SCSI] aic94xx: new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/ME2PR01MB3156AB7DCACA206C845FC7E8AFFDA@ME2PR01MB3156.ausprd01.prod.outlook.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-11 15:21:58 +01:00
..
aacraid
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
2025-08-28 16:28:29 +02:00
aic7xxx
…
aic94xx
scsi: aic94xx: fix use-after-free in device removal path
2026-01-11 15:21:58 +01:00
arcmsr
…
arm
…
be2iscsi
…
bfa
scsi: bfa: Double-free fix
2025-08-28 16:28:26 +02:00
bnx2fc
…
bnx2i
…
csiostor
…
cxgbi
…
cxlflash
…
device_handler
scsi: core: alua: I/O errors for ALUA state transitions
2024-07-25 09:50:39 +02:00
elx
scsi: elx: efct: Fix dma_unmap_sg() nents value
2025-08-15 12:08:54 +02:00
esas2r
…
fcoe
…
fnic
…
hisi_sas
scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
2025-06-19 15:28:12 +02:00
ibmvscsi
…
ibmvscsi_tgt
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
2025-08-15 12:08:54 +02:00
isci
minmax: make generic MIN() and MAX() macros available everywhere
2025-10-02 13:42:55 +02:00
libfc
scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
2025-11-24 10:29:43 +01:00
libsas
scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed
2024-07-25 09:50:53 +02:00
lpfc
scsi: lpfc: Define size of debugfs entry for xri rebalancing
2025-11-24 10:29:40 +01:00
megaraid
scsi: megaraid_sas: Fix invalid node index
2025-07-06 11:00:14 +02:00
mpi3mr
scsi: mpi3mr: Fix controller init failure on fault during queue creation
2025-11-24 10:29:30 +01:00
mpt3sas
scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
2025-11-24 10:29:43 +01:00
mvsas
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
2025-10-19 16:30:42 +02:00
pcmcia
…
pm8001
scsi: pm8001: Use int instead of u32 to store error codes
2025-11-24 10:29:31 +01:00
qedf
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
2025-06-19 15:28:08 +02:00
qedi
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
2024-12-09 10:32:19 +01:00
qla2xxx
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
2026-01-11 15:21:58 +01:00
qla4xxx
scsi: qla4xxx: Prevent a potential error pointer dereference
2025-08-28 16:28:48 +02:00
smartpqi
scsi: smartpqi: Fix device resources accessed after device removal
2026-01-11 15:21:21 +01:00
snic
…
sym53c8xx_2
…
.gitignore
…
3w-9xxx.c
…
3w-9xxx.h
…
3w-sas.c
…
3w-sas.h
…
3w-xxxx.c
…
3w-xxxx.h
…
53c700_d.h_shipped
…
53c700.c
…
53c700.h
…
53c700.scr
…
a100u2w.c
…
a100u2w.h
…
a2091.c
…
a2091.h
…
a3000.c
…
a3000.h
…
a4000t.c
…
advansys.c
…
aha152x.c
…
aha152x.h
…
aha1542.c
…
aha1542.h
…
aha1740.c
…
aha1740.h
…
am53c974.c
…
atari_scsi.c
…
atp870u.c
…
atp870u.h
…
BusLogic.c
…
BusLogic.h
…
bvme6000_scsi.c
…
ch.c
…
constants.c
…
dc395x.c
…
dc395x.h
…
dmx3191d.c
…
esp_scsi.c
…
esp_scsi.h
…
fdomain_isa.c
…
fdomain_pci.c
…
fdomain.c
…
fdomain.h
…
FlashPoint.c
…
g_NCR5380.c
…
gvp11.c
…
gvp11.h
…
hosts.c
scsi: core: Fix a regression triggered by scsi_host_busy()
2025-12-01 11:41:49 +01:00
hpsa_cmd.h
…
hpsa.c
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
2025-10-19 16:30:52 +02:00
hpsa.h
…
hptiop.c
…
hptiop.h
…
imm.c
…
imm.h
…
initio.c
…
initio.h
…
ipr.c
…
ipr.h
…
ips.c
…
ips.h
…
iscsi_boot_sysfs.c
…
iscsi_tcp.c
…
iscsi_tcp.h
…
jazz_esp.c
…
Kconfig
…
lasi700.c
…
libiscsi_tcp.c
…
libiscsi.c
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
2025-08-28 16:28:25 +02:00
mac53c94.c
…
mac53c94.h
…
mac_esp.c
…
mac_scsi.c
scsi: mac_scsi: Disallow bus errors during PDMA send
2024-10-04 16:29:49 +02:00
Makefile
…
megaraid.c
…
megaraid.h
…
mesh.c
…
mesh.h
…
mvme16x_scsi.c
…
mvme147.c
…
mvme147.h
…
mvumi.c
…
mvumi.h
…
myrb.c
…
myrb.h
…
myrs.c
scsi: myrs: Fix dma_alloc_coherent() error check
2025-10-15 11:57:56 +02:00
myrs.h
…
ncr53c8xx.c
…
ncr53c8xx.h
…
NCR5380.c
scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
2024-10-10 11:57:37 +02:00
NCR5380.h
…
nsp32_debug.c
…
nsp32_io.h
…
nsp32.c
…
nsp32.h
…
pmcraid.c
…
pmcraid.h
…
ppa.c
…
ppa.h
…
ps3rom.c
…
qla1280.c
scsi: qla1280: Fix kernel oops when debug level > 2
2025-03-22 12:50:40 -07:00
qla1280.h
scsi: qla1280: Fix hw revision numbering for ISP1020/1040
2025-01-02 10:32:04 +01:00
qlogicfas408.c
…
qlogicfas408.h
…
qlogicfas.c
…
qlogicpti.c
…
qlogicpti.h
…
raid_class.c
…
script_asm.pl
…
scsi_bsg.c
…
scsi_common.c
…
scsi_debug.c
scsi: scsi_debug: Fix hrtimer support for ndelay
2024-12-14 19:59:49 +01:00
scsi_debugfs.c
…
scsi_debugfs.h
…
scsi_devinfo.c
…
scsi_dh.c
…
scsi_error.c
…
scsi_ioctl.c
…
scsi_lib_dma.c
…
scsi_lib.c
scsi: core: Clear flags for scsi_cmnd that did not complete
2025-05-02 07:50:43 +02:00
scsi_logging.c
…
scsi_logging.h
…
scsi_netlink.c
…
scsi_pm.c
…
scsi_priv.h
…
scsi_proc.c
…
scsi_sas_internal.h
…
scsi_scan.c
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
2025-08-28 16:28:29 +02:00
scsi_sysctl.c
…
scsi_sysfs.c
scsi: core: sysfs: Correct sysfs attributes access rights
2025-09-04 15:30:19 +02:00
scsi_trace.c
…
scsi_transport_api.h
…
scsi_transport_fc.c
scsi: scsi_transport_fc: Allow setting rport state to current state
2024-11-08 16:28:21 +01:00
scsi_transport_iscsi.c
scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
2025-08-15 12:09:00 +02:00
scsi_transport_sas.c
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
2025-08-28 16:28:29 +02:00
scsi_transport_spi.c
scsi: spi: Fix sshdr use
2024-08-29 17:33:28 +02:00
scsi_transport_srp.c
…
scsi.c
scsi: Improve CDL control
2025-05-02 07:50:48 +02:00
scsicam.c
…
sd_dif.c
…
sd_trace.h
…
sd_zbc.c
scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
2025-05-22 14:12:22 +02:00
sd.c
scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
2025-08-15 12:09:00 +02:00
sd.h
…
sense_codes.h
…
ses.c
…
sg.c
scsi: sg: Do not sleep in atomic context
2025-12-01 11:41:42 +01:00
sgiwd93.c
…
sim710.c
scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
2026-01-11 15:21:23 +01:00
sni_53c710.c
…
sr_ioctl.c
minmax: scsi: fix mis-use of 'clamp()' in sr.c
2024-08-03 08:54:33 +02:00
sr_vendor.c
…
sr.c
…
sr.h
scsi: sr: Fix unintentional arithmetic wraparound
2024-07-25 09:50:40 +02:00
st_options.h
…
st.c
scsi: st: Restore some drive settings after reset
2025-06-04 14:42:13 +02:00
st.h
scsi: st: Restore some drive settings after reset
2025-06-04 14:42:13 +02:00
stex.c
scsi: stex: Fix reboot_notifier leak in probe error path
2026-01-11 15:21:21 +01:00
storvsc_drv.c
scsi: storvsc: Increase the timeouts to storvsc_timeout
2025-06-27 11:08:59 +01:00
sun3_scsi_vme.c
…
sun3_scsi.c
…
sun3x_esp.c
…
sun_esp.c
…
virtio_scsi.c
…
vmw_pvscsi.c
…
vmw_pvscsi.h
…
wd33c93.c
scsi: wd33c93: Don't use stale scsi_pointer value
2024-10-17 15:24:34 +02:00
wd33c93.h
…
wd719x.c
…
wd719x.h
…
xen-scsifront.c
…
zalon.c
…
zorro7xx.c
…
zorro_esp.c
…