Description
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes. The crash can be easily reproduced with the following commands: # cd /sys/kernel/config/pci_ep/functions/pci_epf_test # for i in {1..20}; do mkdir test && rmdir test; done BUG: kernel NULL pointer dereference, address: 0000000000000088 ... Call Trace: configfs_register_group+0x3d/0x190 pci_epf_cfs_work+0x41/0x110 process_one_work+0x18f/0x350 worker_thread+0x25a/0x3a0 Fix this issue by using configfs_add_default_group() API which does not have the deadlock problem as configfs_register_group() and does not require the delayed work handler. [mani: slightly reworded the description and added stable list]
Product status
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before fa9fb38f5fe9c80094c2138354d45cdc8d094d69
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before 5f609b3bffd4207cf9f2c9b41e1978457a5a1ea9
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before 8cb905eca73944089a0db01443c7628a9e87012d
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before d9af3cf58bb4c8d6dea4166011c780756b1138b5
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before 24a253c3aa6d9a2cde46158ce9782e023bfbf32d
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before 73cee890adafa2c219bb865356e08e7f82423fe5
e85a2d7837622bd99c96f5bbc7f972da90c285a2 (git) before 7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c
5.12
Any version before 5.12
5.15.201 (semver)
6.1.164 (semver)
6.6.127 (semver)
6.12.72 (semver)
6.18.11 (semver)
6.19.1 (semver)
7.0-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/fa9fb38f5fe9c80094c2138354d45cdc8d094d69
git.kernel.org/...c/5f609b3bffd4207cf9f2c9b41e1978457a5a1ea9
git.kernel.org/...c/8cb905eca73944089a0db01443c7628a9e87012d
git.kernel.org/...c/d9af3cf58bb4c8d6dea4166011c780756b1138b5
git.kernel.org/...c/24a253c3aa6d9a2cde46158ce9782e023bfbf32d
git.kernel.org/...c/73cee890adafa2c219bb865356e08e7f82423fe5
git.kernel.org/...c/7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c