{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":136938718,"defaultBranch":"master","name":"linux","ownerLogin":"xairy","currentUserCanPush":false,"isFork":true,"isEmpty":false,"createdAt":"2018-06-11T14:34:52.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/4965052?v=4","public":true,"private":false,"isOrgOwned":false},"refInfo":{"name":"","listCacheKey":"v0:1700503135.0","currentOid":""},"activityList":{"items":[{"before":"c4219b3f0a193b224a93a6dffb191f212c4eee4d","after":null,"ref":"refs/heads/up-stackdepot-evict-v3","pushedAt":"2023-11-20T17:58:55.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"}},{"before":"556d1b6cfd6c412177b8b351365c4a3d562801d5","after":null,"ref":"refs/heads/up-stackdepot-evict-v3-fix","pushedAt":"2023-11-20T17:58:54.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"}},{"before":null,"after":"301a115cf7ce8ddb42ef6de9151c2bb76ba728fc","ref":"refs/heads/up-stackdepot-evict-v4","pushedAt":"2023-11-20T17:58:45.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"lib/stackdepot: adjust DEPOT_POOLS_CAP for KMSAN\n\nKMSAN is frequently used in fuzzing scenarios and thus saves a lot of\nstack traces. As KMSAN does not support evicting stack traces from the\nstack depot, the stack depot capacity might be reached quickly with large\nstack records.\n\nAdjust the maximum number of stack depot pools for this case.\n\nThe average size of a stack trace saved into the stack depot is ~16\nframes. Thus, adjust the maximum pools number accordingly to keep the\nmaximum number of stack traces that can be saved into the stack depot\nsimilar to the one that was allowed before the stack trace eviction\nchanges.\n\nSigned-off-by: Andrey Konovalov ","shortMessageHtmlLink":"lib/stackdepot: adjust DEPOT_POOLS_CAP for KMSAN"}},{"before":"8f6f76a6a29f36d2f3e4510d0bde5046672f6924","after":"98b1cc82c4affc16f5598d4fa14b1858671b2263","ref":"refs/heads/master","pushedAt":"2023-11-20T17:58:31.000Z","pushType":"push","commitsCount":4169,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"Linux 6.7-rc2","shortMessageHtmlLink":"Linux 6.7-rc2"}},{"before":null,"after":"6f361ce9f08437058d5ce125ebc2a3def5e42db4","ref":"refs/heads/wip-udcs-fix-delayed-status","pushedAt":"2023-11-03T14:43:07.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"usb: gadget: f_fs: Stop setup() returning USB_GADGET_DELAYED_STATUS\n\nSigned-off-by: Andrey Konovalov ","shortMessageHtmlLink":"usb: gadget: f_fs: Stop setup() returning USB_GADGET_DELAYED_STATUS"}},{"before":"9c5d00cb7b6bbc5a7965d9ab7d223b5402d1f02c","after":"8f6f76a6a29f36d2f3e4510d0bde5046672f6924","ref":"refs/heads/master","pushedAt":"2023-11-03T14:39:36.000Z","pushType":"push","commitsCount":10000,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"Merge tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull non-MM updates from Andrew Morton:\n \"As usual, lots of singleton and doubleton patches all over the tree\n and there's little I can say which isn't in the individual changelogs.\n\n The lengthier patch series are\n\n - 'kdump: use generic functions to simplify crashkernel reservation\n in arch', from Baoquan He. This is mainly cleanups and\n consolidation of the 'crashkernel=' kernel parameter handling\n\n - After much discussion, David Laight's 'minmax: Relax type checks in\n min() and max()' is here. Hopefully reduces some typecasting and\n the use of min_t() and max_t()\n\n - A group of patches from Oleg Nesterov which clean up and slightly\n fix our handling of reads from /proc/PID/task/... and which remove\n task_struct.thread_group\"\n\n* tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (64 commits)\n scripts/gdb/vmalloc: disable on no-MMU\n scripts/gdb: fix usage of MOD_TEXT not defined when CONFIG_MODULES=n\n .mailmap: add address mapping for Tomeu Vizoso\n mailmap: update email address for Claudiu Beznea\n tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions\n .mailmap: map Benjamin Poirier's address\n scripts/gdb: add lx_current support for riscv\n ocfs2: fix a spelling typo in comment\n proc: test ProtectionKey in proc-empty-vm test\n proc: fix proc-empty-vm test with vsyscall\n fs/proc/base.c: remove unneeded semicolon\n do_io_accounting: use sig->stats_lock\n do_io_accounting: use __for_each_thread()\n ocfs2: replace BUG_ON() at ocfs2_num_free_extents() with ocfs2_error()\n ocfs2: fix a typo in a comment\n scripts/show_delta: add __main__ judgement before main code\n treewide: mark stuff as __ro_after_init\n fs: ocfs2: check status values\n proc: test /proc/${pid}/statm\n compiler.h: move __is_constexpr() to compiler.h\n ...","shortMessageHtmlLink":"Merge tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/…"}},{"before":"f7ab7ad4013669f25808bb0e39b3613b98189063","after":null,"ref":"refs/heads/up-stackdepot-evict-v1","pushedAt":"2023-11-03T14:37:33.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"}},{"before":"6e2367e7693aa107f05c649abe06180fff847bb4","after":null,"ref":"refs/heads/up-stackdepot-evict-v2","pushedAt":"2023-11-03T14:37:32.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"}},{"before":"c5a125bbefbda1621f70bde1b86e8e7005ddc3da","after":null,"ref":"refs/heads/android14-5.15-kasan","pushedAt":"2023-11-03T14:37:21.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"}},{"before":"fc54a5e69ac57a9af2a50a8c4eb96da756c966b3","after":null,"ref":"refs/heads/android14-6.1-kasan","pushedAt":"2023-11-03T14:37:19.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"}},{"before":null,"after":"556d1b6cfd6c412177b8b351365c4a3d562801d5","ref":"refs/heads/up-stackdepot-evict-v3-fix","pushedAt":"2023-11-03T14:37:02.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"fix for \"lib/stackdepot: allow users to evict stack traces\"\n\nCommit \"lib/stackdepot: allow users to evict stack traces\" adds another\nuser for depot_fetch_stack, which holds a write lock. Thus, we need to\nupdate the lockdep annotation.\n\nSigned-off-by: Andrey Konovalov ","shortMessageHtmlLink":"fix for \"lib/stackdepot: allow users to evict stack traces\""}},{"before":null,"after":"c4219b3f0a193b224a93a6dffb191f212c4eee4d","ref":"refs/heads/up-stackdepot-evict-v3","pushedAt":"2023-11-03T14:36:58.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"kasan: use stack_depot_put for tag-based modes\n\nMake tag-based KASAN modes evict stack traces from the stack depot once\nthey are evicted from the stack ring.\n\nInternally, pass STACK_DEPOT_FLAG_GET to stack_depot_save_flags (via\nkasan_save_stack) to increment the refcount when saving a new entry\nto stack ring and call stack_depot_put when removing an entry from\nstack ring.\n\nReviewed-by: Alexander Potapenko \nSigned-off-by: Andrey Konovalov \n\n---\n\nChanges v1->v2:\n- Adapt to the stack depot API change.\n- Drop READ_ONCE when reading entry->stack.","shortMessageHtmlLink":"kasan: use stack_depot_put for tag-based modes"}},{"before":null,"after":"6e2367e7693aa107f05c649abe06180fff847bb4","ref":"refs/heads/up-stackdepot-evict-v2","pushedAt":"2023-11-03T14:36:52.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"kasan: use stack_depot_put for tag-based modes\n\nMake tag-based KASAN modes to evict stack traces from the stack depot\nonce they are evicted from the stack ring.\n\nInternally, pass STACK_DEPOT_FLAG_GET to stack_depot_save_flags (via\nkasan_save_stack) to increment the refcount when saving a new entry\nto stack ring and call stack_depot_put when removing an entry from\nstack ring.\n\nSigned-off-by: Andrey Konovalov \n\n---\n\nChanges v1->v2:\n- Adapt to the stack depot API change.\n- Drop READ_ONCE when reading entry->stack.","shortMessageHtmlLink":"kasan: use stack_depot_put for tag-based modes"}},{"before":"046f364215587a6f608348a75744ad13b37467b5","after":"a913a9f7bef129e39d2ebbd88bd5eee5d40373d9","ref":"refs/heads/usb-dump-ids","pushedAt":"2023-10-21T11:07:40.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"usb: dump usb device ids on hid enumeration\n\nSigned-off-by: Andrey Konovalov \nSigned-off-by: Pavel Skripkin ","shortMessageHtmlLink":"usb: dump usb device ids on hid enumeration"}},{"before":"2dde18cd1d8fac735875f2e4987f11817cc0bc2c","after":"9c5d00cb7b6bbc5a7965d9ab7d223b5402d1f02c","ref":"refs/heads/master","pushedAt":"2023-10-21T10:52:34.000Z","pushType":"push","commitsCount":10000,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"Merge tag 'perf-tools-fixes-for-v6.6-2-2023-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools\n\nPull perf tools fixes from Arnaldo Carvalho de Melo:\n\n - Fix regression in reading scale and unit files from sysfs for PMU\n events, so that we can use that info to pretty print instead of\n printing raw numbers:\n\n # perf stat -e power/energy-ram/,power/energy-gpu/ sleep 2\n\n Performance counter stats for 'system wide':\n\n 1.64 Joules power/energy-ram/\n 0.20 Joules power/energy-gpu/\n\n 2.001228914 seconds time elapsed\n #\n # grep -m1 \"model name\" /proc/cpuinfo\n model name\t: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz\n #\n\n - The small llvm.cpp file used to check if the llvm devel files are\n present was incorrectly deleted when removing the BPF event in 'perf\n trace', put it back as it is also used by tools/bpf/bpftool, that\n uses llvm routines to do disassembly of BPF object files.\n\n - Fix use of addr_location__exit() in dlfilter__object_code(), making\n sure that it is only used to pair a previous addr_location__init()\n call.\n\n* tag 'perf-tools-fixes-for-v6.6-2-2023-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:\n tools build: Fix llvm feature detection, still used by bpftool\n perf dlfilter: Add a test for object_code()\n perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code()\n perf pmu: Fix perf stat output with correct scale and unit","shortMessageHtmlLink":"Merge tag 'perf-tools-fixes-for-v6.6-2-2023-10-20' of git://git.kerne…"}},{"before":null,"after":"f7ab7ad4013669f25808bb0e39b3613b98189063","ref":"refs/heads/up-stackdepot-evict-v1","pushedAt":"2023-08-30T15:37:39.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"kasan: use stack_depot_evict for tag-based modes\n\nEvict stack traces from the stack depot for the tag-based KASAN modes\nonce they are evicted from the stack ring.\n\nSigned-off-by: Andrey Konovalov ","shortMessageHtmlLink":"kasan: use stack_depot_evict for tag-based modes"}},{"before":"f3a2439f20d918930cc4ae8f76fe1c1afd26958f","after":"2dde18cd1d8fac735875f2e4987f11817cc0bc2c","ref":"refs/heads/master","pushedAt":"2023-08-30T15:37:19.000Z","pushType":"push","commitsCount":10000,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"Linux 6.5","shortMessageHtmlLink":"Linux 6.5"}},{"before":null,"after":"fc54a5e69ac57a9af2a50a8c4eb96da756c966b3","ref":"refs/heads/android14-6.1-kasan","pushedAt":"2023-07-12T17:58:15.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"UPSTREAM: kasan: suppress recursive reports for HW_TAGS\n\nKASAN suppresses reports for bad accesses done by the KASAN reporting\ncode. The reporting code might access poisoned memory for reporting\npurposes.\n\nSoftware KASAN modes do this by suppressing reports during reporting via\ncurrent->kasan_depth, the same way they suppress reports during accesses\nto poisoned slab metadata.\n\nHardware Tag-Based KASAN does not use current->kasan_depth, and instead\nresets pointer tags for accesses to poisoned memory done by the reporting\ncode.\n\nDespite that, a recursive report can still happen:\n\n1. On hardware with faulty MTE support. This was observed by Weizhao\n Ouyang on a faulty hardware that caused memory tags to randomly change\n from time to time.\n\n2. Theoretically, due to a previous MTE-undetected memory corruption.\n\nA recursive report can happen via:\n\n1. Accessing a pointer with a non-reset tag in the reporting code, e.g.\n slab->slab_cache, which is what Weizhao Ouyang observed.\n\n2. Theoretically, via external non-annotated routines, e.g. stackdepot.\n\nTo resolve this issue, resetting tags for all of the pointers in the\nreporting code and all the used external routines would be impractical.\n\nInstead, disable tag checking done by the CPU for the duration of KASAN\nreporting for Hardware Tag-Based KASAN.\n\nWithout this fix, Hardware Tag-Based KASAN reporting code might deadlock.\n\n[andreyknvl@google.com: disable preemption instead of migration, fix comment typo]\n Link: https://lkml.kernel.org/r/d14417c8bc5eea7589e99381203432f15c0f9138.1680114854.git.andreyknvl@google.com\nLink: https://lkml.kernel.org/r/59f433e00f7fa985e8bf9f7caf78574db16b67ab.1678491668.git.andreyknvl@google.com\nFixes: 2e903b914797 (\"kasan, arm64: implement HW_TAGS runtime\")\nSigned-off-by: Andrey Konovalov \nReported-by: Weizhao Ouyang \nReviewed-by: Marco Elver \nCc: Alexander Potapenko \nCc: Andrey Ryabinin \nCc: Catalin Marinas \nCc: Dmitry Vyukov \nCc: Evgenii Stepanov \nCc: Peter Collingbourne \nCc: Vincenzo Frascino \nCc: Will Deacon \nSigned-off-by: Andrew Morton \nBug: 254721825\n(cherry picked from commit c6a690e0c978bda8106e7a489c13323f90b087d0)\nSigned-off-by: Andrey Konovalov \nChange-Id: Ifc5daf66f57dd16e85de73257cc0966565836269","shortMessageHtmlLink":"UPSTREAM: kasan: suppress recursive reports for HW_TAGS"}},{"before":null,"after":"30807bebbfb6fe240c791405997d84a5728db53a","ref":"refs/heads/android14-6.1","pushedAt":"2023-07-12T17:53:24.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"ANDROID: GKI: update the ABI symbol list\n\nINFO: ABI DIFFERENCES HAVE BEEN DETECTED!\nINFO: 1 function symbol(s) added\n 'void cpufreq_update_policy(unsigned int)'\n\nBug: 290900322\nChange-Id: Idcebf20a17a642e2b08021772a45003797062edd\nSigned-off-by: wang qiankun ","shortMessageHtmlLink":"ANDROID: GKI: update the ABI symbol list"}},{"before":null,"after":"c5a125bbefbda1621f70bde1b86e8e7005ddc3da","ref":"refs/heads/android14-5.15-kasan","pushedAt":"2023-07-12T17:52:12.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"UPSTREAM: kasan: suppress recursive reports for HW_TAGS\n\nKASAN suppresses reports for bad accesses done by the KASAN reporting\ncode. The reporting code might access poisoned memory for reporting\npurposes.\n\nSoftware KASAN modes do this by suppressing reports during reporting via\ncurrent->kasan_depth, the same way they suppress reports during accesses\nto poisoned slab metadata.\n\nHardware Tag-Based KASAN does not use current->kasan_depth, and instead\nresets pointer tags for accesses to poisoned memory done by the reporting\ncode.\n\nDespite that, a recursive report can still happen:\n\n1. On hardware with faulty MTE support. This was observed by Weizhao\n Ouyang on a faulty hardware that caused memory tags to randomly change\n from time to time.\n\n2. Theoretically, due to a previous MTE-undetected memory corruption.\n\nA recursive report can happen via:\n\n1. Accessing a pointer with a non-reset tag in the reporting code, e.g.\n slab->slab_cache, which is what Weizhao Ouyang observed.\n\n2. Theoretically, via external non-annotated routines, e.g. stackdepot.\n\nTo resolve this issue, resetting tags for all of the pointers in the\nreporting code and all the used external routines would be impractical.\n\nInstead, disable tag checking done by the CPU for the duration of KASAN\nreporting for Hardware Tag-Based KASAN.\n\nWithout this fix, Hardware Tag-Based KASAN reporting code might deadlock.\n\n[andreyknvl@google.com: disable preemption instead of migration, fix comment typo]\n Link: https://lkml.kernel.org/r/d14417c8bc5eea7589e99381203432f15c0f9138.1680114854.git.andreyknvl@google.com\nLink: https://lkml.kernel.org/r/59f433e00f7fa985e8bf9f7caf78574db16b67ab.1678491668.git.andreyknvl@google.com\nFixes: 2e903b914797 (\"kasan, arm64: implement HW_TAGS runtime\")\nSigned-off-by: Andrey Konovalov \nReported-by: Weizhao Ouyang \nReviewed-by: Marco Elver \nCc: Alexander Potapenko \nCc: Andrey Ryabinin \nCc: Catalin Marinas \nCc: Dmitry Vyukov \nCc: Evgenii Stepanov \nCc: Peter Collingbourne \nCc: Vincenzo Frascino \nCc: Will Deacon \nSigned-off-by: Andrew Morton \nBug: 254721825\n(cherry picked from commit c6a690e0c978bda8106e7a489c13323f90b087d0)\nSigned-off-by: Andrey Konovalov \nChange-Id: Ifc5daf66f57dd16e85de73257cc0966565836269","shortMessageHtmlLink":"UPSTREAM: kasan: suppress recursive reports for HW_TAGS"}},{"before":"60a2ccabe2dd370daef159c6ef3ac7e26f2db9f6","after":"0c09eb760b2ec0703658de9f7ea4b0965696785c","ref":"refs/heads/android14-5.15","pushedAt":"2023-07-12T17:52:06.000Z","pushType":"push","commitsCount":10,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"ANDROID: Update the ABI symbol list\n\nAdding the following symbols:\n - __get_task_comm\n\nBug: 260174400\nChange-Id: I25953c46a6eb5c0ea136101a77ded198b3f796ce\nSigned-off-by: Robin Peng ","shortMessageHtmlLink":"ANDROID: Update the ABI symbol list"}},{"before":null,"after":"60a2ccabe2dd370daef159c6ef3ac7e26f2db9f6","ref":"refs/heads/android14-5.15","pushedAt":"2023-07-12T17:47:42.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"xairy","name":"Andrey Konovalov","path":"/xairy","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/4965052?s=80&v=4"},"commit":{"message":"UPSTREAM: usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition\n\n[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ]\n\nIn renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.\nrenesas_usb3_start will be called to start the work.\n\nIf we remove the driver which will call usbhs_remove, there may be\nan unfinished work. The possible sequence is as follows:\n\nCPU0 \t\t\tCPU1\n\n \t\t\t renesas_usb3_role_work\nrenesas_usb3_remove\nusb_role_switch_unregister\ndevice_unregister\nkfree(sw)\n//free usb3->role_sw\n \t\t\t usb_role_switch_set_role\n \t\t\t //use usb3->role_sw\n\nThe usb3->role_sw could be freed under such circumstance and then\nused in usb_role_switch_set_role.\n\nThis bug was found by static analysis. And note that removing a\ndriver is a root-only operation, and should never happen in normal\ncase. But the root user may directly remove the device which\nwill also trigger the remove function.\n\nFix it by canceling the work before cleanup in the renesas_usb3_remove.\n\nBug: 289003615\nFixes: 39facfa01c9f (\"usb: gadget: udc: renesas_usb3: Add register of usb role switch\")\nSigned-off-by: Zheng Wang \nReviewed-by: Yoshihiro Shimoda \nLink: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com\nSigned-off-by: Greg Kroah-Hartman \nSigned-off-by: Sasha Levin \n(cherry picked from commit df2380520926bdbc264cffab0f45da9a21f304c8)\nSigned-off-by: Lee Jones \nChange-Id: I79a1dbeba9a90ee5daf94648ef6a32207b283561","shortMessageHtmlLink":"UPSTREAM: usb: gadget: udc: renesas_usb3: Fix use after free bug in r…"}}],"hasNextPage":false,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAADs47yQAA","startCursor":null,"endCursor":null}},"title":"Activity · xairy/linux"}