net: usb: fix possible use-after-free in smsc75xx_bind
Dongliang Mu authored
[ Upstream commit 56b786d8 ]

The commit 46a8b29c ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.

Fixes: 46a8b29c

 ("net: usb: fix memory leak in smsc75xx_bind")
Signed-off-by: default avatarDongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
c4e3be2e
Name Last commit Last update
Documentation tweewide: Fix most Shebang lines
arch ARM: OMAP2+: Fix build warning when mmc_omap is not built
block blk-mq: Swap two calls in blk_mq_exit_queue()
certs certs: Fix blacklist flag type confusion
crypto crypto: api - check for ERR pointers in crypto_destroy_tfm()
drivers net: usb: fix possible use-after-free in smsc75xx_bind
firmware Fix built-in early-load Intel microcode alignment
fs gfs2: Fix use-after-free in gfs2_glock_shrink_scan
include HID: usbhid: fix info leak in hid_submit_ctrl
init pid: take a reference when initializing `cad_pid`
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
kernel tracing: Correct the length check which causes memory corruption
lib lib: stackdepot: turn depot_lock spinlock to raw_spinlock
mm mm/memory-failure: make sure wait for page writeback in memory_failure
net netfilter: synproxy: Fix out of bounds when parsing TCP options
samples samples/bpf: Fix broken tracex1 due to kprobe argument change
scripts scripts: switch explicitly to Python 3
security security: commoncap: fix -Wstringop-overread warning
sound ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
tools perf session: Correct buffer copying when peeking events
usr initramfs: restore default compression behavior
virt KVM: arm64: Fix exclusive limit for IPA size
.cocciconfig scripts: add Linux .cocciconfig for coccinelle
.get_maintainer.ignore Add hch to .get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README
Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.