f6ab594672
The asd_pci_remove() function fails to synchronize with pending tasklets
before freeing the asd_ha structure, leading to a potential
use-after-free vulnerability.
When a device removal is triggered (via hot-unplug or module unload),
race condition can occur.
The fix adds tasklet_kill() before freeing the asd_ha structure,
ensuring all scheduled tasklets complete before cleanup proceeds.
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| aic94xx.h | ||
| aic94xx_dev.c | ||
| aic94xx_dump.c | ||
| aic94xx_dump.h | ||
| aic94xx_hwi.c | ||
| aic94xx_hwi.h | ||
| aic94xx_init.c | ||
| aic94xx_reg.c | ||
| aic94xx_reg.h | ||
| aic94xx_reg_def.h | ||
| aic94xx_sas.h | ||
| aic94xx_scb.c | ||
| aic94xx_sds.c | ||
| aic94xx_sds.h | ||
| aic94xx_seq.c | ||
| aic94xx_seq.h | ||
| aic94xx_task.c | ||
| aic94xx_tmf.c | ||