shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 19:30:30 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
0725367fc9c98c8b339ea882b820f4e6bb55b109
linux/drivers
History
Jann Horn 742f306229 tty: Fix ->pgrp locking in tiocspgrp() 
commit 54ffccbf05 upstream.

tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.

To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.

This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.

Fixes: 47f86834bb ("redo locking of tty->pgrp")
CC: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:37:59 +01:00
..
accessibility
…
acpi
ACPI: GED: fix -Wformat
2020-11-22 09:58:15 +01:00
amba
…
android
binder: Prevent context manager from incrementing ref 0
2020-08-21 11:01:55 +02:00
ata
ata: sata_rcar: Fix DMA boundary mask
2020-11-10 10:23:51 +01:00
atm
atm: nicstar: Unmap DMA on send error
2020-11-24 13:02:52 +01:00
auxdisplay
…
base
device property: Don't clear secondary pointer for shared primary firmware node
2020-11-10 10:24:00 +01:00
bcma
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-29 10:24:31 +01:00
block
xen/blkback: use lateeoi irq binding
2020-11-18 18:26:30 +01:00
bluetooth
Bluetooth: btusb: fix PM leak in error case of setup
2020-01-12 11:24:16 +01:00
bus
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
2020-04-24 07:58:46 +02:00
cdrom
…
char
random32: make prandom_u32() output unpredictable
2020-11-18 18:26:29 +01:00
clk
clk: ti: clockdomain: fix static checker warning
2020-11-10 10:23:54 +01:00
clocksource
clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init()
2020-10-01 20:40:17 +02:00
connector
…
cpufreq
acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
2020-11-10 10:23:56 +01:00
cpuidle
cpuidle: Fix three reference count leaks
2020-06-20 10:24:18 +02:00
crypto
crypto: ccp - fix error handling
2020-10-29 09:05:41 +01:00
dax
…
dca
…
devfreq
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 20:40:02 +02:00
dio
…
dma
dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
2020-12-02 08:31:26 +01:00
dma-buf
…
edac
EDAC/i5100: Fix error handling order in i5100_init_one()
2020-10-29 09:05:32 +01:00
eisa
…
extcon
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-30 15:38:28 -04:00
firewire
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
firmware
efi: Make it possible to disable efivar_ssdt entirely
2020-07-09 09:35:57 +02:00
fmc
…
fpga
…
gpio
gpio: tc35894: fix up tc35894 interrupt configuration
2020-10-14 09:48:12 +02:00
gpu
drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
2020-11-18 18:26:28 +01:00
hid
HID: hid-sensor-hub: Fix issue with devices with no report ID
2020-12-02 08:31:26 +01:00
hsi
…
hv
Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
2020-09-23 08:46:15 +02:00
hwmon
hwmon: (applesmc) check status earlier.
2020-09-12 11:47:32 +02:00
hwspinlock
…
hwtracing
intel_th: Fix user-visible error codes
2020-04-02 17:20:25 +02:00
i2c
i2c: mux: pca954x: Add missing pca9546 definition to chip_desc
2020-11-22 09:58:14 +01:00
ide
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
idle
…
iio
iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
2020-11-24 13:03:07 +01:00
infiniband
RDMA/i40iw: Address an mmap handler exploit in i40iw
2020-12-11 13:37:58 +01:00
input
Input: i8042 - add ByteSpeed touchpad to noloop table
2020-12-11 13:37:58 +01:00
iommu
iommu/amd: Increase interrupt remapping table limit to 512 entries
2020-11-18 18:26:27 +01:00
ipack
…
irqchip
irqchip/gic: Atomically update affinity
2020-07-22 09:10:54 +02:00
isdn
…
leds
leds: bcm6328, bcm6358: use devres LED registering function
2020-11-10 10:23:56 +01:00
lguest
…
lightnvm
…
macintosh
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-20 10:24:21 +02:00
mailbox
…
mcb
…
md
md/raid5: fix oops during stripe resizing
2020-11-10 10:23:55 +01:00
media
media: tw5864: check status of tw5864_frameinterval_get
2020-11-10 10:23:53 +01:00
memory
memory: emif: Remove bogus debugfs error handling
2020-11-10 10:23:55 +01:00
memstick
…
message
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-10 10:23:57 +01:00
mfd
misc: rtsx: Fix memory leak in rtsx_pci_probe
2020-10-29 09:05:44 +01:00
misc
mei: protect mei_cl_mtu from null dereference
2020-11-18 18:26:28 +01:00
mmc
mmc: via-sdmmc: Fix data race bug
2020-11-10 10:23:53 +01:00
mtd
ubi: check kthread_should_stop() after the setting of task state
2020-11-10 10:23:59 +01:00
net
net/mlx5: Fix wrong address reclaim when command interface is down
2020-12-11 13:37:57 +01:00
nfc
nfc: s3fwrn5: use signed integer for parsing GPIO numbers
2020-12-02 08:31:27 +01:00
ntb
NTB: hw: amd: fix an issue about leak system resources
2020-10-29 09:05:41 +01:00
nubus
…
nvdimm
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
nvme
nvmet: fix uninitialized work for zero kato
2020-10-29 09:05:41 +01:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-06-11 09:22:22 +02:00
of
of/address: Fix of_node memory leak in of_dma_is_coherent
2020-11-18 18:26:27 +01:00
oprofile
…
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-21 11:02:06 +02:00
parport
…
pci
PCI: Add device even if driver attach failed
2020-12-02 08:31:25 +01:00
pcmcia
…
perf
…
phy
phy: tegra: xusb: Fix dangling pointer on probe failure
2020-12-02 08:31:27 +01:00
pinctrl
pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
2020-12-11 13:37:58 +01:00
platform
platform/x86: toshiba_acpi: Fix the wrong variable assignment
2020-12-02 08:31:28 +01:00
pnp
…
power
power: supply: test_power: add missing newlines when printing parameters by sysfs
2020-11-10 10:23:54 +01:00
powercap
powercap: restrict energy meter to root access
2020-11-10 21:04:57 +01:00
pps
…
ps3
…
ptp
ptp: free ptp device pin descriptors properly
2020-05-20 08:15:33 +02:00
pwm
pwm: bcm-iproc: handle clk_get_rate() return
2020-08-21 11:02:10 +02:00
rapidio
rapidio: fix the missed put_device() for rio_mport_add_riodev
2020-10-29 09:05:39 +01:00
ras
…
regulator
regulator: workaround self-referent regulators
2020-12-02 08:31:29 +01:00
remoteproc
remoteproc: Fix wrong rvring index computation
2020-05-02 17:23:14 +02:00
reset
…
rpmsg
…
rtc
rtc: rx8010: don't modify the global rtc ops
2020-11-10 10:23:59 +01:00
s390
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-03 11:21:19 +02:00
sbus
…
scsi
scsi: ufs: Fix race between shutdown and runtime resume flow
2020-12-02 08:31:27 +01:00
sfi
…
sh
…
sn
…
soc
soc: qcom: smem: Use le32_to_cpu for comparison
2020-04-24 07:59:10 +02:00
spi
spi: Fix controller unregister order harder
2020-12-11 13:37:58 +01:00
spmi
…
ssb
…
staging
staging: octeon: Drop on uncorrectable alignment or FCS error
2020-11-10 10:24:01 +01:00
target
scsi: target: iscsi: Fix cmd abort fabric stop race
2020-12-02 08:31:26 +01:00
tc
…
thermal
thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
2020-09-12 11:47:34 +02:00
thunderbolt
…
tty
tty: Fix ->pgrp locking in tiocspgrp()
2020-12-11 13:37:59 +01:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb
USB: serial: option: add support for Thales Cinterion EXS82
2020-12-11 13:37:59 +01:00
uwb
…
vfio
vfio/pci: Clear token on bypass registration failure
2020-10-29 09:05:40 +01:00
vhost
vringh: fix __vringh_iov() when riov and wiov are different
2020-11-10 10:23:59 +01:00
video
video: hyperv_fb: Fix the cache type when mapping the VRAM
2020-12-02 08:31:27 +01:00
virt
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:05:35 +01:00
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:29:05 +02:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-28 15:42:33 +01:00
w1
w1: mxc_w1: Fix timeout resolution problem leading to bus error
2020-11-10 10:23:57 +01:00
watchdog
drivers: watchdog: rdc321x_wdt: Fix race condition bugs
2020-11-10 10:23:54 +01:00
xen
xen/events: block rogue events for some time
2020-11-18 18:26:31 +01:00
zorro
…
Kconfig
…
Makefile
…