Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 208489032bdd8d4a7de50f3057c175058f271956 before 9e799f25c420e759641eb25102967ea091fc758f; affected 208489032bdd8d4a7de50f3057c175058f271956 before f37e0367ad6f2147a0b37564b442b7a25bec0d23; affected 208489032bdd8d4a7de50f3057c175058f271956 before 46e75703ca3f00fb8c935b3ce35b90836e34e8af; affected 208489032bdd8d4a7de50f3057c175058f271956 before edef1355224c0799a502a46b71d3649fa0dd218e; affected 208489032bdd8d4a7de50f3057c175058f271956 before b38af5386a74416e898955443f2e26547b358cb2 |
| Linux / Linux | affected 4.2; unaffected 0 before 4.2; unaffected 6.6.160 through 6.6.*; unaffected 6.12.113 through 6.12.*; unaffected 6.18.57 through 6.18.*; unaffected 7.2.11 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f
- https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23
- https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af
- https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e
- https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2