shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-04-02 11:13:02 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
5d2b286eb034af114f67d9967fc3fbc1829bb712
linux/drivers
History
Gaosheng Cui 5d2b286eb0 staging: vme_user: Fix possible UAF in tsi148_dma_list_add 
[ Upstream commit 357057ee55 ]

Smatch report warning as follows:

drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:
  '&entry->list' not removed from list

In tsi148_dma_list_add(), the error path "goto err_dma" will not
remove entry->list from list->entries, but entry will be freed,
then list traversal may cause UAF.

Fix by removeing it from list->entries before free().

Fixes: b2383c90a9 ("vme: tsi148: fix first DMA item mapping")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Link: https://lore.kernel.org/r/20221117035914.2954454-1-cuigaosheng1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-14 10:15:55 +01:00
..
accessibility
speakup: fix a segfault caused by switching consoles
2022-11-25 17:45:50 +01:00
acpi
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
2023-01-14 10:15:21 +01:00
amba
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
android
file: Rename __close_fd_get_file close_fd_get_file
2023-01-04 11:39:18 +01:00
ata
pata_ipx4xx_cf: Fix unsigned comparison with less than zero
2023-01-14 10:15:23 +01:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:38:02 +02:00
auxdisplay
auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-18 14:04:24 +01:00
base
class: fix possible memory leak in __class_register()
2023-01-14 10:15:54 +01:00
bcma
bcma: Fix memory leak for internally-handled cores
2021-09-15 09:50:45 +02:00
block
drbd: fix an invalid memory access caused by incorrect use of list iterator
2023-01-14 10:15:32 +01:00
bluetooth
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
2023-01-14 10:15:45 +01:00
bus
bus: sunxi-rsb: Support atomic transfers
2022-12-02 17:39:59 +01:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 12:06:55 +02:00
char
hwrng: geode - Fix PCI device refcount leak
2023-01-14 10:15:54 +01:00
clk
clk: socfpga: Fix memory leak in socfpga_gate_init()
2023-01-14 10:15:42 +01:00
clocksource
clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
2023-01-14 10:15:20 +01:00
connector
…
counter
counter: microchip-tcb-capture: Handle Signal1 read and Synapse
2022-11-03 23:57:50 +09:00
cpufreq
cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
2023-01-14 10:15:18 +01:00
cpuidle
cpuidle: dt: Return the correct numbers of parsed idle states
2023-01-14 10:15:15 +01:00
crypto
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
2023-01-14 10:15:53 +01:00
dax
devdax: Fix soft-reservation memory description
2022-09-28 11:10:41 +02:00
dca
…
devfreq
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
2022-07-07 17:52:18 +02:00
dio
drivers: dio: fix possible memory leak in dio_init()
2023-01-14 10:15:54 +01:00
dma
dmaengine: at_hdmac: Check return code of dma_async_device_register
2022-11-16 09:57:20 +01:00
dma-buf
dma-buf: fix racing conflict of dma_heap_add()
2022-12-02 17:40:01 +01:00
edac
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
2023-01-14 10:15:18 +01:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 18:32:43 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:25:32 +02:00
firmware
firmware: coreboot: Register bus in module init
2022-11-25 17:45:53 +01:00
fpga
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
2022-10-26 13:25:33 +02:00
fsi
fsi: core: Check error number after calling ida_simple_get
2022-10-26 13:25:38 +02:00
gnss
…
gpio
gpio: amd8111: Fix PCI device reference count leak
2022-12-14 11:32:00 +01:00
gpu
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
2023-01-14 10:15:35 +01:00
greybus
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-08 14:39:50 +02:00
hid
HID: hid-sensor-custom: set fixed size for custom attributes
2023-01-14 10:15:31 +01:00
hsi
HSI: omap_ssi_port: Fix dma_map_sg error check
2022-10-26 13:25:32 +02:00
hv
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
2022-12-02 17:40:00 +01:00
hwmon
hwmon: (jc42) Restore the min/max/critical temperatures on resume
2023-01-14 10:15:37 +01:00
hwspinlock
hwspinlock: qcom: correct MMIO max register for newer SoCs
2022-11-16 09:57:07 +01:00
hwtracing
coresight: cti: Fix hang in cti_disable_hw()
2022-11-10 18:14:25 +01:00
i2c
i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
2022-12-08 11:23:59 +01:00
i3c
Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
2021-05-14 09:50:05 +02:00
ide
ide/falconide: Fix module unload
2021-03-04 11:38:21 +01:00
idle
intel_idle: Disable IBRS during long idle
2022-07-25 11:26:43 +02:00
iio
iio: light: rpr0521: add missing Kconfig dependencies
2022-12-08 11:23:54 +01:00
infiniband
IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
2023-01-14 10:15:54 +01:00
input
Input: elants_i2c - properly handle the reset GPIO when power is off
2023-01-14 10:15:30 +01:00
interconnect
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
2022-09-28 11:10:28 +02:00
iommu
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
2022-12-08 11:23:58 +01:00
ipack
ipack: ipoctal: fix module reference leak
2021-10-06 15:56:01 +02:00
irqchip
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
2023-01-14 10:15:18 +01:00
isdn
mISDN: fix misuse of put_device() in mISDN_register_device()
2022-11-25 17:45:46 +01:00
leds
leds: lm3601x: Don't use mutex after it was destroyed
2022-10-26 13:25:18 +02:00
lightnvm
lightnvm: disable the subsystem
2022-05-09 09:04:56 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 13:06:47 +02:00
mailbox
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
2022-10-26 13:25:40 +02:00
mcb
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:11:00 +02:00
md
dm integrity: clear the journal on suspend
2022-12-02 17:40:05 +01:00
media
media: coda: Add check for kmalloc
2023-01-14 10:15:40 +01:00
memory
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
2022-10-26 13:25:28 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-21 15:15:58 +02:00
message
…
mfd
mtd: spi-nor: intel-spi: Disable write protection only if asked
2022-11-25 17:45:41 +01:00
misc
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
2022-11-25 17:45:54 +01:00
mmc
mmc: mmci: fix return value check of mmc_add_host()
2023-01-14 10:15:40 +01:00
most
most: fix control-message timeouts
2021-11-18 14:03:51 +01:00
mtd
mtd: maps: pxa2xx-flash: fix memory leak in probe
2023-01-14 10:15:32 +01:00
mux
…
net
stmmac: fix potential division by 0
2023-01-14 10:15:45 +01:00
nfc
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
2022-12-02 17:40:02 +01:00
ntb
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:38:01 +02:00
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:52:15 +02:00
nvme
nvme-pci: clear the prp2 field when not used
2022-12-19 12:27:32 +01:00
nvmem
nvmem: core: set size for sysfs bin file
2022-01-27 10:54:22 +01:00
of
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
2023-01-14 10:15:42 +01:00
opp
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-21 15:16:04 +02:00
oprofile
…
parisc
parisc: Export iosapic_serial_irq() symbol for serial port driver
2022-11-10 18:14:27 +01:00
parport
parport_pc: Avoid FIFO port location truncation
2022-11-25 17:45:44 +01:00
pci
PCI: Check for alloc failure in pci_request_irq()
2023-01-14 10:15:50 +01:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 18:32:30 +02:00
perf
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
2023-01-14 10:15:12 +01:00
phy
phy: stm32: fix an error code in probe
2022-11-16 09:57:08 +01:00
pinctrl
pinctrl: pinconf-generic: add missing of_node_put()
2023-01-14 10:15:32 +01:00
platform
platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
2023-01-14 10:15:22 +01:00
pnp
PNP: fix name memory leak in pnp_alloc_dev()
2023-01-14 10:15:17 +01:00
power
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
2022-10-26 13:25:52 +02:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:25:44 +02:00
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-13 21:00:55 +02:00
pwm
pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource()
2022-08-21 15:15:37 +02:00
rapidio
rapidio: devices: fix missing put_device in mport_cdev_open
2023-01-14 10:15:23 +01:00
ras
RAS/CEC: Correct ce_add_elem()'s returned values
2021-04-14 08:42:12 +02:00
regulator
regulator: core: fix resource leak in regulator_register()
2023-01-14 10:15:37 +01:00
remoteproc
remoteproc: sysmon: Wait for SSCTL service to come up
2022-08-21 15:16:08 +02:00
reset
reset: imx7: Fix the iMX8MP PCIe PHY PERST support
2022-10-05 10:38:40 +02:00
rpmsg
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-15 07:55:54 +02:00
rtc
rtc: mc146818-lib: fix signedness bug in mc146818_get_time()
2022-12-14 11:31:59 +01:00
s390
s390/dasd: fix no record found for raw_track_access
2022-12-02 17:40:02 +01:00
sbus
…
scsi
scsi: snic: Fix possible UAF in snic_tgt_create()
2023-01-14 10:15:52 +01:00
sfi
…
sh
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:39:12 +01:00
siox
siox: fix possible memory leak in siox_device_add()
2022-11-25 17:45:44 +01:00
slimbus
slimbus: stream: correct presence rate frequencies
2022-11-25 17:45:50 +01:00
soc
soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
2023-01-14 10:15:11 +01:00
soundwire
soundwire: intel: fix error handling on dai registration issues
2022-10-26 13:25:53 +02:00
spi
spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
2023-01-14 10:15:41 +01:00
spmi
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 13:25:39 +02:00
ssb
ssb: Fix error return code in ssb_bus_scan()
2021-07-14 16:56:21 +02:00
staging
media: meson: vdec: fix possible refcount leak in vdec_probe()
2022-11-10 18:14:22 +01:00
target
scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
2022-11-25 17:45:55 +01:00
tc
…
tee
tee: optee: fix possible memory leak in optee_register_device()
2022-12-02 17:39:59 +01:00
thermal
thermal: intel_powerclamp: Use first online CPU as control_cpu
2022-10-26 13:25:56 +02:00
thunderbolt
thunderbolt: Explicitly enable lane adapter hotplug events at startup
2022-10-26 13:25:16 +02:00
tty
serial: tegra: Read DMA status before terminating
2023-01-14 10:15:54 +01:00
uio
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
2023-01-14 10:15:55 +01:00
usb
usb: fotg210-udc: Fix ages old endianness issues
2023-01-14 10:15:55 +01:00
vdpa
vdpasim: allow to enable a vq repeatedly
2022-06-09 10:21:29 +02:00
vfio
vfio: platform: Do not pass return buffer to ACPI _RST method
2023-01-14 10:15:54 +01:00
vhost
vhost/vsock: Use kvmalloc/kvfree for larger packets.
2022-10-26 13:25:22 +02:00
video
fbcon: Use kzalloc() in fbcon_prepare_logo()
2022-12-14 11:31:54 +01:00
virt
vboxguest: Do not use devm for irq
2022-08-25 11:38:14 +02:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 21:20:13 +02:00
visorbus
visorbus: fix error return code in visorchipset_init()
2021-07-14 16:56:41 +02:00
vlynq
…
vme
staging: vme_user: Fix possible UAF in tsi148_dma_list_add
2023-01-14 10:15:55 +01:00
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-13 21:01:01 +02:00
watchdog
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-21 15:16:10 +02:00
xen
xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
2023-01-14 10:15:21 +01:00
zorro
…
Kconfig
…
Makefile
…