shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 19:30:30 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
42624bc8c30c463a9155286bb716223ad04dd2a7
linux/drivers
History
Hyunwoo Kim 42624bc8c3 media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 
[ Upstream commit 280a8ab817 ]

If the device node of dvb_ca_en50221 is open() and the
device is disconnected, a UAF may occur when calling
close() on the device node.

The root cause is that wake_up() and wait_event() for
dvbdev->wait_queue are not implemented.

So implement wait_event() function in dvb_ca_en50221_release()
and add 'remove_mutex' which prevents race condition
for 'ca->exit'.

[mchehab: fix a checkpatch warning]

Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-09 10:32:24 +02:00
..
accessibility
tty: fix possible null-ptr-defer in spk_ttyio_release
2023-01-24 07:22:46 +01:00
acpi
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
2023-05-24 17:36:44 +01:00
amba
…
android
binder: fix UAF of alloc->vma in race with munmap()
2023-06-05 09:21:25 +02:00
ata
ata: libata: Fix sata_down_spd_limit() when no link speed is reported
2023-02-09 11:26:37 +01:00
atm
atm: idt77252: fix kmemleak when rmmod idt77252
2023-03-30 12:47:48 +02:00
auxdisplay
auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
2023-03-11 13:57:22 +01:00
base
regmap: cache: Return error in cache sync operations for REGCACHE_NONE
2023-05-24 17:36:43 +01:00
bcma
…
block
block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
2023-06-09 10:32:21 +02:00
bluetooth
Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
2023-05-24 17:36:46 +01:00
bus
bus: mhi: host: Range check CHDBOFF and ERDBOFF
2023-05-17 11:50:14 +02:00
cdrom
…
char
tpm/tpm_tis: Disable interrupts for more Lenovo devices
2023-05-24 17:36:55 +01:00
clk
clk: tegra20: fix gcc-7 constant overflow warning
2023-05-24 17:36:47 +01:00
clocksource
clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails
2023-05-11 23:00:37 +09:00
comedi
comedi: adv_pci1760: Fix PWM instruction handling
2023-01-24 07:22:45 +01:00
connector
…
counter
counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
2023-04-26 13:51:55 +02:00
cpufreq
cpufreq: use correct unit when verify cur freq
2023-05-11 23:00:25 +09:00
cpuidle
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
2023-03-22 13:31:36 +01:00
crypto
crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs()
2023-05-17 11:50:20 +02:00
cxl
…
dax
dax/kmem: Fix leak of memory-hotplug resources
2023-03-10 09:40:08 +01:00
dca
…
devfreq
PM/devfreq: governor: Add a private governor_data for governor
2023-01-12 11:58:51 +01:00
dio
drivers: dio: fix possible memory leak in dio_init()
2022-12-31 13:14:27 +01:00
dma
dmaengine: pl330: rename _start to prevent build error
2023-06-09 10:32:15 +02:00
dma-buf
dma-buf: fix racing conflict of dma_heap_add()
2022-12-02 17:41:06 +01:00
edac
EDAC/skx: Fix overflows on the DRAM row address mapping arrays
2023-05-11 23:00:20 +09:00
eisa
…
extcon
extcon: usbc-tusb320: fix kernel-doc warning
2023-02-06 07:59:01 +01:00
firewire
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
2023-02-09 11:26:32 +01:00
firmware
firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors
2023-05-30 13:55:33 +01:00
fpga
fpga: bridge: fix kernel-doc parameter description
2023-05-11 23:00:31 +09:00
fsi
WRITE is "data source", not destination...
2023-02-09 11:26:34 +01:00
gnss
…
gpio
gpio: mockup: Fix mode of debugfs files
2023-05-30 13:55:30 +01:00
gpu
drm/ast: Fix ARM compatibility
2023-06-09 10:32:20 +02:00
greybus
…
hid
HID: wacom: add three styli to wacom_intuos_get_tool_type
2023-05-24 17:36:55 +01:00
hsi
HSI: omap_ssi_core: Fix error handling in ssi_init()
2022-12-31 13:14:32 +01:00
hv
Drivers: vmbus: Check for channel allocation before looking up relids
2023-04-13 16:48:17 +02:00
hwmon
hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E
2023-05-11 23:00:25 +09:00
hwspinlock
…
hwtracing
coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
2023-05-30 13:55:32 +01:00
i2c
i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
2023-05-11 23:00:33 +09:00
i3c
…
idle
…
iio
iio: light: max44009: add missing OF device matching
2023-05-11 23:00:32 +09:00
infiniband
RDMA/irdma: Fix Local Invalidate fencing
2023-06-09 10:32:17 +02:00
input
Input: xpad - add constants for GIP interface numbers
2023-05-24 17:36:48 +01:00
interconnect
interconnect: qcom: osm-l3: fix icc_onecell_data allocation
2023-03-30 12:47:41 +02:00
iommu
iommu/amd: Don't block updates to GATag if guest mode is on
2023-06-09 10:32:15 +02:00
ipack
…
irqchip
irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
2023-06-05 09:21:23 +02:00
isdn
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
2022-12-31 13:14:37 +01:00
leds
leds: tca6507: Fix error handling of using fwnode_property_read_string
2023-05-11 23:00:37 +09:00
macintosh
macintosh: via-pmu-led: requires ATA to be set
2023-05-11 23:00:34 +09:00
mailbox
mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
2023-06-09 10:32:20 +02:00
mcb
mcb-pci: Reallocate memory region to avoid memory overlapping
2023-05-24 17:36:47 +01:00
md
dm: don't lock fs when the map is NULL in process of resume
2023-05-11 23:00:40 +09:00
media
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
2023-06-09 10:32:24 +02:00
memory
memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
2023-02-01 08:27:03 +01:00
memstick
memstick: r592: Fix UAF bug in r592_remove due to race condition
2023-05-24 17:36:43 +01:00
message
scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
2023-05-24 17:36:45 +01:00
mfd
mfd: dln2: Fix memory leak in dln2_probe()
2023-05-24 17:36:48 +01:00
misc
vmci_host: fix a race condition in vmci_host_poll() causing GPF
2023-05-11 23:00:32 +09:00
mmc
mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works
2023-05-30 13:55:30 +01:00
most
…
mtd
mtd: rawnand: marvell: don't set the NAND frequency select
2023-06-09 10:32:19 +02:00
mux
…
net
net: dsa: mv88e6xxx: Increase wait after reset deactivation
2023-06-09 10:32:19 +02:00
nfc
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
2023-03-22 13:31:26 +01:00
ntb
…
nubus
…
nvdimm
…
nvme
nvme-pci: add quirk for missing secondary temperature thresholds
2023-06-09 10:32:22 +02:00
nvmem
nvmem: core: fix return value
2023-02-22 12:57:03 +01:00
of
of: Fix modalias string generation
2023-05-11 23:00:32 +09:00
opp
OPP: fix error checking in opp_migrate_dentry()
2023-03-10 09:39:15 +01:00
parisc
parisc: Replace regular spinlock with spin_trylock on panic path
2023-05-24 17:36:48 +01:00
parport
…
pci
PCI/EDR: Clear Device Status after EDR error recovery
2023-05-11 23:00:32 +09:00
pcmcia
…
perf
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
2022-12-31 13:13:58 +01:00
phy
phy: st: miphy28lp: use _poll_timeout functions for waits
2023-05-24 17:36:48 +01:00
pinctrl
pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration
2023-05-11 23:00:37 +09:00
platform
platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield
2023-06-09 10:32:20 +02:00
pnp
PNP: fix name memory leak in pnp_alloc_dev()
2022-12-31 13:14:02 +01:00
power
power: supply: bq24190: Call power_supply_changed() after updating input current
2023-06-05 09:21:13 +02:00
powercap
powercap: fix possible name leak in powercap_register_zone()
2023-03-10 09:39:12 +01:00
pps
…
ps3
…
ptp
ptp_qoriq: fix memory leak in probe()
2023-04-05 11:24:55 +02:00
pwm
pwm: mtk-disp: Configure double buffering before reading in .get_state()
2023-05-11 23:00:38 +09:00
rapidio
rapidio: devices: fix missing put_device in mport_cdev_open
2022-12-31 13:14:05 +01:00
ras
…
regulator
regulator: mt6359: add read check for PMIC MT6359
2023-05-30 13:55:33 +01:00
remoteproc
remoteproc: stm32_rproc: Add mutex protection for workqueue
2023-05-24 17:36:44 +01:00
reset
reset: uniphier-glue: Fix possible null-ptr-deref
2023-02-01 08:27:04 +01:00
rpmsg
rpmsg: glink: Avoid infinite loop on intent for missing channel
2023-03-10 09:39:46 +01:00
rtc
rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
2023-05-11 23:00:35 +09:00
s390
s390/qdio: fix do_sqbs() inline assembly constraint
2023-05-24 17:36:55 +01:00
sbus
…
scsi
scsi: storvsc: Don't pass unused PFNs to Hyper-V host
2023-05-24 17:36:52 +01:00
sh
genirq: Add and use an irq_data_update_affinity helper
2023-03-11 13:57:31 +01:00
siox
…
slimbus
…
soc
soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
2023-05-11 23:00:20 +09:00
soundwire
soundwire: qcom: gracefully handle too many ports in DT
2023-05-24 17:36:48 +01:00
spi
spi: fsl-cpm: Use 16 bit mode for large transfers with even size
2023-05-30 13:55:29 +01:00
spmi
spmi: Add a check for remove callback when removing a SPMI driver
2023-05-11 23:00:34 +09:00
ssb
…
staging
staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
2023-05-24 17:36:46 +01:00
target
scsi: target: iscsit: Free cmds before session free
2023-05-24 17:36:45 +01:00
tc
…
tee
tee: amdtee: fix race condition in amdtee_open_session
2023-03-30 12:47:59 +02:00
thermal
thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe
2023-05-11 23:00:38 +09:00
thunderbolt
thunderbolt: Clear registers properly when auto clear isn't in use
2023-05-24 17:36:54 +01:00
tty
vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
2023-05-24 17:36:54 +01:00
uio
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
2022-12-31 13:14:27 +01:00
usb
USB: sisusbvga: Add endpoint checks
2023-05-30 13:55:31 +01:00
vdpa
vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
2023-03-22 13:31:24 +01:00
vfio
vfio/type1: restore locked_vm
2023-03-10 09:40:13 +01:00
vhost
vhost/net: Clear the pending messages when the backend is removed
2023-02-09 11:26:34 +01:00
video
fbdev: stifb: Fix info entry in sti_struct on error path
2023-06-09 10:32:21 +02:00
virt
…
virtio
virtio_ring: don't update event idx on get_buf
2023-05-11 23:00:34 +09:00
visorbus
…
vlynq
…
vme
vme: Fix error not catched in fake_init()
2022-12-31 13:14:30 +01:00
w1
w1: fix WARNING after calling w1_process()
2023-02-01 08:27:14 +01:00
watchdog
watchdog: menz069_wdt: fix watchdog initialisation
2023-06-09 10:32:19 +02:00
xen
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
2023-05-30 13:55:32 +01:00
zorro
…
Kconfig
…
Makefile
…