In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tty: serial: max3100: shut down timer before freeing port<\/p>\n
max3100_shutdown() stops the polling timer but returns early during
\nsystem suspend. If the SPI device is unbound before resume, the serial
\ncore does not call max3100_shutdown() again, so max3100_remove() frees
\nthe port while the timer remains armed. max3100_timeout() may then
\naccess the freed port and re-arm the timer.<\/p>\n
Add final timer teardown to max3100_remove() and use
\ntimer_shutdown_sync() to prevent a racing callback from re-arming it.
\nAlso free the IRQ and destroy the workqueue there before freeing the
\nport. Keep timer_delete_sync() in max3100_shutdown() so that a
\nsubsequent open() can re-arm the timer.<\/p>\n
The workqueue is created before request_irq() and destroyed on both
\nrequest_irq() failure and normal shutdown. Its presence at remove thus
\nidentifies the IRQ left registered when suspend bypasses shutdown.<\/p>\n
Free the IRQ before destroying the workqueue, in both
\nmax3100_shutdown() and max3100_remove(), and cancel the pending work
\nin between. free_irq() waits for a running interrupt handler to
\nfinish and no new handler can start afterwards, so a racing handler
\ncannot queue work on a workqueue that is being destroyed; the
\nforce_end_work check in max3100_dowork() only narrows that window, as
\na handler delayed between the check and queue_work() could still run
\nafter the teardown has cleared the workqueue pointer. Cancelling the
\nwork also keeps destroy_workqueue() from waiting on a queued work item
\nin case remove() ever runs while the freezable workqueue is still
\nfrozen, e.g. device removal during the resume window, before
\nworkqueues are thawed.<\/p>\n
This issue was found by an in-house static analysis tool.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tty: serial: max3100: shut down timer before freeing port<\/p>\n
max3100_shutdown() stops the polling timer but returns early during
\nsyst<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41221","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}