kernel/linux.git/drivers/most, branch v6.1.168

most: usb: fix double free on late probe failure

2025-12-06T21:12:43+00:00

commit baadf2a5c26e802a46573eaad331b427b49aaa36 upstream. The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration. This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures. Fixes: 723de0f9171e ("staging: most: remove device from interface structure") Fixes: 4b1270902609 ("most: usb: Fix use-after-free in hdm_disconnect") Fixes: a8cc9e5fcb0e ("most: usb: hdm_probe: Fix calling put_device() before device initialization") Cc: stable@vger.kernel.org Cc: Christian Gromm Cc: Victoria Votokina Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251029093029.28922-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

most: usb: hdm_probe: Fix calling put_device() before device initialization

2025-10-29T13:04:39+00:00

commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 upstream. The early error path in hdm_probe() can jump to err_free_mdev before &mdev->dev has been initialized with device_initialize(). Calling put_device(&mdev->dev) there triggers a device core WARN and ends up invoking kref_put(&kobj->kref, kobject_release) on an uninitialized kobject. In this path the private struct was only kmalloc'ed and the intended release is effectively kfree(mdev) anyway, so free it directly instead of calling put_device() on an uninitialized device. This removes the WARNING and fixes the pre-initialization error path. Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Cc: stable Signed-off-by: Victoria Votokina Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com Signed-off-by: Greg Kroah-Hartman

most: usb: Fix use-after-free in hdm_disconnect

2025-10-29T13:04:39+00:00

commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 upstream. hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing. The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts). Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface(). This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below. Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com Cc: stable Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761 Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Signed-off-by: Victoria Votokina Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com Signed-off-by: Greg Kroah-Hartman

most: core: Drop device reference after usage in get_channel()

2025-08-28T14:26:14+00:00

commit b47b493d6387ae437098112936f32be27f73516c upstream. In get_channel(), the reference obtained by bus_find_device_by_name() was dropped via put_device() before accessing the device's driver data Move put_device() after usage to avoid potential issues. Fixes: 2485055394be ("staging: most: core: drop device reference") Cc: stable Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20250804082955.3621026-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman

most: usb: replace snprintf in show functions with sysfs_emit

2021-11-26T16:03:47+00:00

coccicheck complains about the use of snprintf() in sysfs show functions: WARNING use scnprintf or sprintf Use sysfs_emit instead of scnprintf, snprintf or sprintf makes more sense. Reported-by: Zeal Robot Signed-off-by: Jing Yao Link: https://lore.kernel.org/r/20211110025341.136194-1-yao.jing2@zte.com.cn Signed-off-by: Greg Kroah-Hartman

most: fix control-message timeouts

2021-10-26T17:12:01+00:00

USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Use the common control-message timeout defines for the five-second timeouts. Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Cc: stable@vger.kernel.org # 5.9 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20211025115811.5410-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

MOST: cdev: rename 'mod_init' & 'mod_exit' functions to be module-specific

2021-07-21T13:46:22+00:00

Rename module_init & module_exit functions that are named "mod_init" and "mod_exit" so that they are unique in both the System.map file and in initcall_debug output instead of showing up as almost anonymous "mod_init". This is helpful for debugging and in determining how long certain module_init calls take to execute. Signed-off-by: Randy Dunlap Acked-by: Christian Gromm Link: https://lore.kernel.org/r/20210711223148.5250-5-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman

Merge tag 'staging-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2021-04-26T18:14:21+00:00

Pull staging/IIO driver updates from Greg KH: "Here is the big set of staging and IIO driver updates for 5.13-rc1. Lots of little churn in here, and some larger churn as well. Major things are: - removal of wimax drivers, no one has this hardware anymore for this failed "experiment". - removal of the Google gasket driver, turns out no one wanted to maintain it or cares about it anymore, so they asked for it to be removed. - comedi finally moves out of the staging directory into drivers/comedi This is one of the oldest kernel subsystems around, being created in the 2.0 kernel days, and was one of the first things added to drivers/staging/ when that was created over 15 years ago. It should have been moved out of staging a long time ago, it's well maintained and used by loads of different devices in the real world every day. Nice to see this finally happen. - so many tiny coding style cleanups it's not funny. Perfect storm of at least 2 different intern project application deadlines combined to provide a huge number of new contributions in this area from people learning how to do kernel development. Great job to everyone involved here. There's also the normal updates for IIO drivers with new IIO drivers and updates all over that subsystem. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (907 commits) staging: octeon: Use 'for_each_child_of_node' Staging: rtl8723bs: rtw_xmit: fixed tabbing issue staging: rtl8188eu: remove unused function parameters staging: rtl8188eu: cmdThread is a task_struct staging: rtl8188eu: remove constant variable and dead code staging: rtl8188eu: change bLeisurePs' type to bool staging: rtl8723bs: remove empty #ifdef block staging: rtl8723bs: remove unused DBG_871X_LEVEL macro declarations staging: rtl8723bs: split too long line staging: rtl8723bs: fix indentation in if block staging: rtl8723bs: fix code indent issue staging: rtl8723bs: replace DBG_871X_LEVEL logs with netdev_*() staging: rtl8192e: indent statement properly staging: rtl8723bs: Remove led_blink_hdl() and everything related staging: comedi: move out of staging directory staging: rtl8723bs: remove sdio_drv_priv structure staging: rtl8723bs: remove unused argument in function staging: rtl8723bs: remove DBG_871X_SEL_NL macro declaration staging: rtl8723bs: replace DBG_871X_SEL_NL with netdev_dbg() staging: rtl8723bs: fix indentation issue introduced by long line split ...

drivers: most: use LIST_HEAD() for list_head

2021-04-02T14:26:03+00:00

There's no need to declare a list and then init it manually, just use the LIST_HEAD() macro. Signed-off-by: Shixin Liu Link: https://lore.kernel.org/r/20210329094015.66942-2-liushixin2@huawei.com Signed-off-by: Greg Kroah-Hartman

drivers: most: use DEFINE_SPINLOCK() for spinlock

2021-04-02T14:26:03+00:00

spinlock can be initialized automatically with DEFINE_SPINLOCK() rather than explicitly calling spin_lock_init(). Signed-off-by: Shixin Liu Link: https://lore.kernel.org/r/20210329094015.66942-1-liushixin2@huawei.com Signed-off-by: Greg Kroah-Hartman