shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-10 12:57:06 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
29d0c45cf16e5be1b33561b3d3184dbd56e45586
linux/drivers
History
Jianglei Nie 56ee957791 drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() 
commit 540dfd188e upstream.

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and
free the memory.Thus, when nouveau_bo_init() returns an error, the gem
object has already been released. Then the call to nouveau_bo_ref() will
use the freed "nvbo->bo" and lead to a use-after-free bug.

We should delete the call to nouveau_bo_ref() to avoid the use-after-free.

Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 019cbd4a4f ("drm/nouveau: Initialize GEM object before TTM object")
Cc: Thierry Reding <treding@nvidia.com>
Cc: <stable@vger.kernel.org> # v5.4+
Link: https://patchwork.freedesktop.org/patch/msgid/20220705132546.2247677-1-niejianglei2021@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 13:22:21 +02:00
..
accessibility
…
acpi
ACPI: processor: Remove freq Qos request for all CPUs
2022-09-05 10:27:44 +02:00
amba
…
android
binder: fix UAF of ref->proc caused by race condition
2022-09-15 12:04:51 +02:00
ata
libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205
2022-10-05 10:37:42 +02:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:18:26 +02:00
auxdisplay
…
base
x86/bugs: Report AMD retbleed vulnerability
2022-10-07 09:16:54 +02:00
bcma
…
block
loop: Check for overflow while configuring loop
2022-09-05 10:27:43 +02:00
bluetooth
Bluetooth: hci_intel: Add check for platform_driver_register
2022-08-25 11:17:47 +02:00
bus
bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
2022-08-25 11:17:35 +02:00
cdrom
…
char
random: use expired timer rather than wq for mixing fast pool
2022-10-15 07:54:40 +02:00
clk
clk: iproc: Do not rely on node name for correct PLL setup
2022-10-05 10:37:45 +02:00
clocksource
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
2022-07-07 17:36:53 +02:00
connector
…
counter
…
cpufreq
x86/devicetable: Move x86 specific macro out of generic code
2022-10-07 09:16:54 +02:00
cpuidle
…
crypto
crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
2022-08-25 11:17:48 +02:00
dax
dax: make sure inodes are flushed before destroy cache
2022-04-15 14:18:12 +02:00
dca
…
devfreq
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
2022-07-07 17:36:49 +02:00
dio
…
dma
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
2022-10-15 07:54:37 +02:00
dma-buf
udmabuf: Set the DMA mask for the udmabuf device (v2)
2022-09-05 10:27:45 +02:00
edac
EDAC/synopsys: Read the error count from the correct register
2022-04-27 13:50:48 +02:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 18:12:00 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:23:41 +02:00
firmware
firmware: arm_scmi: Add SCMI PM driver remove routine
2022-10-15 07:54:37 +02:00
fpga
fpga: altera-pr-ip: fix unsigned comparison with less than zero
2022-08-25 11:17:51 +02:00
fsi
…
gnss
…
gpio
gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx
2022-09-28 11:03:57 +02:00
gpu
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
2022-10-26 13:22:21 +02:00
greybus
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-15 14:17:58 +02:00
hid
HID: multitouch: Add memory barriers
2022-10-26 13:22:14 +02:00
hsi
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 09:19:41 +01:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 11:04:08 +02:00
hwmon
hwmon: (gpio-fan) Fix array out of bounds access
2022-09-15 12:04:52 +02:00
hwspinlock
…
hwtracing
intel_th: pci: Add Meteor Lake-P support
2022-08-25 11:18:13 +02:00
i2c
i2c: mux-gpmux: Add of_node_put() when breaking out of loop
2022-08-25 11:17:47 +02:00
i3c
…
ide
…
idle
intel_idle: Disable IBRS during long idle
2022-10-07 09:16:55 +02:00
iio
iio: pressure: dps310: Reset chip after timeout
2022-10-26 13:22:12 +02:00
infiniband
RDMA/mlx5: Set local port to one when accessing counters
2022-09-15 12:04:55 +02:00
input
Input: xpad - fix wireless 360 controller breaking after suspend
2022-10-15 07:54:41 +02:00
interconnect
…
iommu
iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
2022-08-25 11:18:15 +02:00
ipack
…
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:18:32 +02:00
isdn
mISDN: change function names to avoid conflicts
2022-01-11 15:23:33 +01:00
leds
…
lightnvm
lightnvm: disable the subsystem
2022-05-09 09:03:20 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 12:57:53 +02:00
mailbox
mailbox: forward the hrtimer if not queued and under a lock
2022-06-14 18:11:42 +02:00
mcb
…
md
md: call __md_stop_writes in md_stop
2022-09-05 10:27:44 +02:00
media
media: dvb_vb2: fix possible out of bound access
2022-10-05 10:37:43 +02:00
memory
memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
2022-04-20 09:19:34 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-25 11:17:55 +02:00
message
…
mfd
mfd: max77620: Fix refcount leak in max77620_initialise_fps
2022-08-25 11:18:04 +02:00
misc
misc: fastrpc: fix memory corruption on open
2022-09-15 12:04:51 +02:00
mmc
mmc: sdhci-sprd: Fix minimum clock limit
2022-10-26 13:22:13 +02:00
mtd
mtd: rawnand: atmel: Unmap streaming DMA mappings
2022-10-26 13:22:11 +02:00
mux
…
net
can: kvaser_usb_leaf: Fix CAN state after restart
2022-10-26 13:22:13 +02:00
nfc
NFC: nxp-nci: don't print header length mismatch on i2c error
2022-07-21 20:59:25 +02:00
ntb
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:18:26 +02:00
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:36:48 +02:00
nvme
nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
2022-10-05 10:37:45 +02:00
nvmem
…
of
of: mdio: Add of_node_put() when breaking out of for_each_xx
2022-09-28 11:04:06 +02:00
opp
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-25 11:18:00 +02:00
oprofile
…
parisc
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
2022-09-28 11:03:57 +02:00
parport
…
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 13:22:16 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 18:11:50 +02:00
perf
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
2022-09-20 12:27:59 +02:00
phy
phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
2022-06-14 18:11:52 +02:00
pinctrl
pinctrl: amd: Don't save/restore interrupt status and wake status bits
2022-09-05 10:27:39 +02:00
platform
platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
2022-09-20 12:28:00 +02:00
pnp
…
power
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
2022-07-29 17:14:10 +02:00
powercap
…
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-15 14:18:32 +02:00
pwm
pwm: lp3943: Fix duty calculation in case period was clamped
2022-06-14 18:11:51 +02:00
rapidio
…
ras
…
regulator
regulator: qcom_rpm: Fix circular deferral regression
2022-10-26 13:22:15 +02:00
remoteproc
remoteproc: qcom: wcnss: Fix handling of IRQs
2022-08-25 11:18:02 +02:00
reset
reset: tegra-bpmp: Restore Handle errors in BPMP response
2022-04-27 13:50:47 +02:00
rpmsg
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-15 07:54:38 +02:00
rtc
rtc: mt6397: check return value after calling platform_get_resource()
2022-06-14 18:11:53 +02:00
s390
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
2022-09-28 11:04:08 +02:00
sbus
…
scsi
scsi: stex: Properly zero out the passthrough command structure
2022-10-15 07:54:39 +02:00
sfi
…
sh
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:47:17 +01:00
siox
…
slimbus
slimbus: qcom: Fix IRQ check in qcom_slim_probe
2022-05-18 09:47:27 +02:00
soc
soc: sunxi: sram: Fix debugfs info for A64 SRAM C
2022-10-05 10:37:44 +02:00
soundwire
soundwire: bus_type: fix remove and shutdown support
2022-08-25 11:17:54 +02:00
spi
spi: spi-rspi: Fix PIO fallback on RZ platforms
2022-08-25 11:17:32 +02:00
spmi
…
ssb
…
staging
media: cedrus: Set the platform driver data earlier
2022-10-26 13:22:20 +02:00
target
scsi: target: tcmu: Fix possible page UAF
2022-04-20 09:19:36 +02:00
tc
…
tee
tee: add overflow check in register_shm_helper()
2022-08-25 11:18:27 +02:00
thermal
thermal: sysfs: Fix cooling_device_stats_setup() error code path
2022-08-25 11:17:22 +02:00
thunderbolt
thunderbolt: Use the actual buffer in tb_async_error()
2022-09-15 12:04:52 +02:00
tty
serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting
2022-09-28 11:04:08 +02:00
uio
…
usb
usb: add quirks for Lenovo OneLink+ Dock
2022-10-26 13:22:12 +02:00
vfio
vfio: Clear the caps->buf to NULL after free
2022-08-25 11:18:36 +02:00
vhost
vringh: Fix loop descriptors check in the indirect cases
2022-06-14 18:12:02 +02:00
video
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
2022-10-26 13:22:16 +02:00
virt
vboxguest: Do not use devm for irq
2022-08-25 11:18:33 +02:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 20:59:24 +02:00
visorbus
…
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-15 14:18:35 +02:00
watchdog
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-25 11:18:06 +02:00
xen
xen/xenbus: fix return type in xenbus_file_read()
2022-08-25 11:18:26 +02:00
zorro
…
Kconfig
…
Makefile
…