shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-04-01 02:33:01 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
021c294dff030f3ba38eb81e400ba123db32ecbc
linux/drivers
History
Pavel Skripkin 021c294dff media: zr364xx: fix memory leak in zr364xx_start_readpipe 
commit 0a045eac8d upstream.

syzbot reported memory leak in zr364xx driver.
The problem was in non-freed urb in case of
usb_submit_urb() fail.

backtrace:
  [<ffffffff82baedf6>] kmalloc include/linux/slab.h:561 [inline]
  [<ffffffff82baedf6>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
  [<ffffffff82f7cce8>] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022
  [<ffffffff84251dfc>] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]
  [<ffffffff84251dfc>] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516
  [<ffffffff82bb6507>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
  [<ffffffff826018a9>] really_probe+0x159/0x500 drivers/base/dd.c:576

Fixes: ccbf035ae5 ("V4L/DVB (12278): zr364xx: implement V4L2_CAP_STREAMING")
Cc: stable@vger.kernel.org
Reported-by: syzbot+af4fa391ef18efdd5f69@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-20 16:16:06 +02:00
..
accessibility
…
acpi
ACPI: sysfs: Fix a buffer overrun problem with description_show()
2021-07-20 16:15:48 +02:00
amba
amba: Fix resource leak for drivers without .remove
2021-03-04 09:39:46 +01:00
android
binder: fix UAF when releasing todo list
2020-10-29 09:54:56 +01:00
ata
ata: ahci_sunxi: Disable DIPM
2021-07-20 16:16:04 +02:00
atm
atm: nicstar: register the interrupt handler in the right place
2021-07-20 16:16:01 +02:00
auxdisplay
auxdisplay: ht16k33: Fix refresh rate handling
2021-03-04 09:39:45 +01:00
base
regmap: set debugfs_name to NULL after it is freed
2021-05-22 10:59:28 +02:00
bcma
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-27 14:51:09 +01:00
block
drivers/block/null_blk/main: Fix a double free in null_init.
2021-05-22 10:59:34 +02:00
bluetooth
Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
2021-07-20 16:16:03 +02:00
bus
bus: qcom: Put child node before return
2021-05-22 10:59:29 +02:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:48:34 +02:00
char
ipmi/watchdog: Stop watchdog timer when the current action is 'none'
2021-07-20 16:16:05 +02:00
clk
clk: tegra: Ensure that PLLU configuration is applied properly
2021-07-20 16:16:00 +02:00
clocksource
clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
2021-07-20 16:16:04 +02:00
connector
connector: fix unsafe usage of ->real_parent
2019-03-19 13:12:38 +01:00
cpufreq
cpufreq: armada-37xx: Fix determining base CPU frequency
2021-05-22 10:59:31 +02:00
cpuidle
cpuidle: Fixup IRQ state
2020-09-09 19:04:23 +02:00
crypto
crypto: nx - Fix RCU warning in nx842_OF_upd_status
2021-07-20 16:15:48 +02:00
dax
mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses
2019-05-22 07:37:40 +02:00
dca
…
devfreq
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 13:14:26 +02:00
dio
…
dma
dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
2021-06-30 08:48:25 -04:00
dma-buf
dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling)
2020-10-01 13:14:24 +02:00
edac
EDAC/ti: Add missing MODULE_DEVICE_TABLE
2021-07-20 16:15:45 +02:00
eisa
…
extcon
extcon: max8997: Add missing modalias string
2021-07-20 16:15:57 +02:00
firewire
firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
2021-04-07 12:48:50 +02:00
firmware
qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
2021-07-20 16:16:04 +02:00
fmc
…
fpga
fpga: dfl: fix bug in port reset handshake
2020-07-29 10:16:48 +02:00
fsi
fsi/sbefifo: Fix reset timeout
2021-07-20 16:15:55 +02:00
gnss
gnss: sirf: fix error return code in sirf_probe()
2020-06-22 09:05:28 +02:00
gpio
gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055
2021-05-22 10:59:49 +02:00
gpu
drm/msm/mdp4: Fix modifier support enabling
2021-07-20 16:16:04 +02:00
hid
HID: wacom: Correct base usage for capacitive ExpressKey status bits
2021-07-20 16:15:46 +02:00
hsi
HSI: core: fix resource leaks in hsi_add_client_from_dt()
2021-05-22 10:59:34 +02:00
hv
hv_utils: Fix passing zero to 'PTR_ERR' warning
2021-07-20 16:15:45 +02:00
hwmon
hwmon: (max31790) Fix fan speed reporting for fan7..12
2021-07-20 16:15:48 +02:00
hwspinlock
…
hwtracing
coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
2021-07-20 16:16:05 +02:00
i2c
i2c: robotfuzz-osif: fix control-request directions
2021-06-30 08:48:34 -04:00
ide
block: genhd: add 'groups' argument to device_add_disk
2021-03-11 14:04:59 +01:00
idle
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:17:53 +02:00
iio
iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
2021-07-20 16:15:56 +02:00
infiniband
RDMA/cma: Fix rdma_resolve_route() memory leak
2021-07-20 16:16:02 +02:00
input
Input: hil_kbd - fix error return code in hil_dev_connect()
2021-07-20 16:15:55 +02:00
iommu
iommu/vt-d: Fix sysfs leak in alloc_iommu()
2021-06-03 08:38:02 +02:00
ipack
ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
2021-07-20 16:16:05 +02:00
irqchip
irqchip/gic-v3: Fix OF_BAD_ADDR error handling
2021-05-22 10:59:30 +02:00
isdn
mISDN: fix possible use-after-free in HFC_cleanup()
2021-07-20 16:15:59 +02:00
leds
leds: ktd2692: Fix an error handling path
2021-07-20 16:15:57 +02:00
lightnvm
lightnvm: select CONFIG_CRC32
2021-01-17 14:04:22 +01:00
macintosh
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-22 09:05:29 +02:00
mailbox
mailbox: avoid timer start from callback
2020-10-30 10:38:21 +01:00
mcb
…
md
dm btree remove: assign new_root only when removal succeeds
2021-07-20 16:16:05 +02:00
media
media: zr364xx: fix memory leak in zr364xx_start_readpipe
2021-07-20 16:16:06 +02:00
memory
memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
2021-05-22 10:59:27 +02:00
memstick
block: genhd: add 'groups' argument to device_add_disk
2021-03-11 14:04:59 +01:00
message
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-05 11:08:47 +01:00
mfd
mfd: stm32-timers: Avoid clearing auto reload register
2021-05-22 10:59:34 +02:00
misc
eeprom: idt_89hpesx: Restore printing the unsupported fwnode name
2021-07-20 16:15:56 +02:00
mmc
mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
2021-07-20 16:16:04 +02:00
mtd
mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume()
2021-07-20 16:15:57 +02:00
mux
…
net
sfc: error code if SRIOV cannot be disabled
2021-07-20 16:16:02 +02:00
nfc
nfc: pn533: prevent potential memory corruption
2021-05-22 10:59:35 +02:00
ntb
NTB: hw: amd: fix an issue about leak system resources
2020-10-30 10:38:25 +01:00
nubus
…
nvdimm
block: genhd: add 'groups' argument to device_add_disk
2021-03-11 14:04:59 +01:00
nvme
nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue()
2021-06-30 08:48:12 -04:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-06-10 21:35:00 +02:00
of
of: Fix truncation of memory sizes on 32-bit platforms
2021-07-20 16:15:57 +02:00
opp
OPP: Fix missing debugfs supply directory for OPPs
2020-01-27 14:50:04 +01:00
oprofile
…
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-19 08:15:07 +02:00
parport
parport: load lowlevel driver if ports not found
2019-12-31 16:36:01 +01:00
pci
PCI: aardvark: Fix checking for PIO Non-posted Request
2021-07-20 16:16:05 +02:00
pcmcia
…
perf
perf/arm_pmu_platform: Fix error handling
2021-05-22 10:59:15 +02:00
phy
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
2021-07-20 16:15:57 +02:00
pinctrl
pinctrl/amd: Add device HID for new AMD GPIO controller
2021-07-20 16:16:04 +02:00
platform
platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard()
2021-07-20 16:15:46 +02:00
pnp
…
power
power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()
2021-05-22 10:59:17 +02:00
powercap
powercap: restrict energy meter to root access
2020-11-10 21:11:27 +01:00
pps
drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
2019-08-04 09:30:56 +02:00
ps3
powerpc/ps3: use dma_mapping_error()
2020-12-30 11:26:04 +01:00
ptp
ptp: improve max_adj check against unreasonable values
2021-06-30 08:48:19 -04:00
pwm
pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()
2021-03-04 09:39:48 +01:00
rapidio
rapidio: handle create_workqueue() failure
2021-05-26 11:48:33 +02:00
ras
RAS/CEC: Fix pfn insertion
2019-07-26 09:14:05 +02:00
regulator
regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
2021-07-20 16:15:45 +02:00
remoteproc
remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
2021-02-13 13:51:14 +01:00
reset
reset: uniphier: Add SCSSI reset control for each channel
2020-02-24 08:34:44 +01:00
rpmsg
rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
2021-05-22 10:59:42 +02:00
rtc
rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path
2021-07-20 16:15:41 +02:00
s390
s390/cio: dont call css_wait_for_slow_path() inside a lock
2021-07-20 16:15:41 +02:00
sbus
…
scsi
scsi: mpt3sas: Fix error return value in _scsih_expander_add()
2021-07-20 16:15:57 +02:00
sfi
…
sh
…
siox
…
slimbus
slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
2020-12-30 11:25:57 +01:00
sn
…
soc
soc: qcom: mdt_loader: Detect truncated read of segments
2021-05-22 10:59:30 +02:00
soundwire
soundwire: stream: fix memory leak in stream config error path
2021-05-22 10:59:30 +02:00
spi
spi: spi-sun6i: Fix chipselect/clock bug
2021-07-20 16:15:48 +02:00
spmi
…
ssb
ssb: Fix error return code in ssb_bus_scan()
2021-07-20 16:15:50 +02:00
staging
staging: mt7621-dts: fix pci address for PCI memory range
2021-07-20 16:15:56 +02:00
target
scsi: target: core: Fix warning on realtime kernels
2021-06-30 08:48:11 -04:00
tc
…
tee
tee: optee: do not check memref size on return from Secure World
2021-05-22 10:59:15 +02:00
thermal
thermal/core/fair share: Lock the thermal zone while looping over instances
2021-05-22 10:59:47 +02:00
thunderbolt
thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
2021-06-03 08:38:04 +02:00
tty
serial: mvebu-uart: fix calculation of clock divisor
2021-07-20 16:16:03 +02:00
uio
uio: Fix use-after-free in uio_unregister_device()
2020-11-18 19:18:49 +01:00
usb
usb: gadget: f_fs: Fix setting of device and driver data cross-references
2021-07-20 16:16:03 +02:00
uwb
…
vfio
vfio/pci: Handle concurrent vma faults
2021-07-20 16:15:58 +02:00
vhost
vhost: Fix vhost_vq_reset()
2021-04-07 12:48:48 +02:00
video
video: hgafb: correctly handle card detect failure during probe
2021-05-26 11:48:35 +02:00
virt
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:55:09 +01:00
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:31:01 +02:00
visorbus
visorbus: fix error return code in visorchipset_init()
2021-07-20 16:15:55 +02:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-24 08:34:47 +01:00
w1
w1: mxc_w1: Fix timeout resolution problem leading to bus error
2020-11-05 11:08:47 +01:00
watchdog
watchdog: mei_wdt: request stop on unregister
2021-03-04 09:39:55 +01:00
xen
xen/events: reset active flag for lateeoi events later
2021-07-11 12:49:31 +02:00
zorro
…
Kconfig
…
Makefile
…