|
| 1 | +PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| 2 | + |
| 3 | +jira LE-3822 |
| 4 | +cve CVE-2025-38137 |
| 5 | +Rebuild_History Non-Buildable kernel-6.12.0-55.27.1.el10_0 |
| 6 | +commit-author Brian Norris < [email protected]> |
| 7 | +commit 8b926f237743f020518162c62b93cb7107a2b5eb |
| 8 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 9 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 10 | +ciq/ciq_backports/kernel-6.12.0-55.27.1.el10_0/8b926f23.failed |
| 11 | + |
| 12 | +It's possible to trigger use-after-free here by: |
| 13 | + |
| 14 | + (a) forcing rescan_work_func() to take a long time and |
| 15 | + (b) utilizing a pwrctrl driver that may be unloaded for some reason |
| 16 | + |
| 17 | +Cancel outstanding work to ensure it is finished before we allow our data |
| 18 | +structures to be cleaned up. |
| 19 | + |
| 20 | +[bhelgaas: tidy commit log] |
| 21 | +Fixes: 8f62819aaace ("PCI/pwrctl: Rescan bus on a separate thread") |
| 22 | + Signed-off-by: Brian Norris < [email protected]> |
| 23 | + Signed-off-by: Brian Norris < [email protected]> |
| 24 | + Signed-off-by: Krzysztof Wilczyński < [email protected]> |
| 25 | + Signed-off-by: Bjorn Helgaas < [email protected]> |
| 26 | + Reviewed-by: Manivannan Sadhasivam < [email protected]> |
| 27 | + Acked-by: Bartosz Golaszewski < [email protected]> |
| 28 | + Cc: Konrad Dybcio < [email protected]> |
| 29 | +Link: https://patch.msgid.link/20250409115313.1.Ia319526ed4ef06bec3180378c9a008340cec9658@changeid |
| 30 | +(cherry picked from commit 8b926f237743f020518162c62b93cb7107a2b5eb) |
| 31 | + Signed-off-by: Jonathan Maple < [email protected]> |
| 32 | + |
| 33 | +# Conflicts: |
| 34 | +# drivers/pci/pwrctrl/core.c |
| 35 | +* Unmerged path drivers/pci/pwrctrl/core.c |
| 36 | +* Unmerged path drivers/pci/pwrctrl/core.c |
0 commit comments