shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-31 18:23:00 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
7cf412def885406f0948d037ef8869dd593ea236
linux/drivers
History
dan.carpenter@oracle.com d5684b0515 HID: hiddev: Fix race in in hiddev_disconnect() 
commit 5c02c447ea upstream.

Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock.  This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.

Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: 7f77897ef2 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-05 16:43:45 +01:00
..
accessibility
…
acpi
ACPI: watchdog: Fix gas->access_width usage
2020-03-05 16:43:42 +01:00
amba
Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm
2019-10-23 06:26:33 -04:00
android
binder: fix log spam for existing debugfs file creation.
2020-02-01 09:34:35 +00:00
ata
ata: ahci: Add shutdown to freeze hardware resources of ahci
2020-02-28 17:22:28 +01:00
atm
fore200e: Fix incorrect checks of NULL pointer dereference
2020-02-24 08:36:36 +01:00
auxdisplay
Merge tag 'docs-5.4' of git://git.lwn.net/linux
2019-09-17 16:22:26 -07:00
base
driver core: platform: fix u32 greater or equal to zero comparison
2020-02-24 08:36:55 +01:00
bcma
bcma: make arrays pwr_info_offset and sprom_sizes static const, shrinks object size
2019-09-13 16:44:49 +03:00
block
floppy: check FDC index for errors before assigning it
2020-02-28 17:22:14 +01:00
bluetooth
Bluetooth: btusb: Disable runtime suspend on Realtek devices
2020-02-11 04:35:09 -08:00
bus
bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
2020-02-24 08:36:35 +01:00
cdrom
cdrom: respect device capabilities during opening action
2020-01-04 19:18:25 +01:00
char
ipmi:ssif: Handle a possible NULL pointer reference
2020-03-05 16:43:35 +01:00
clk
clk: uniphier: Add SCSSI clock gate for each channel
2020-02-24 08:36:42 +01:00
clocksource
clocksource: davinci: only enable clockevents once tim34 is initialized
2020-02-24 08:36:46 +01:00
connector
…
counter
…
cpufreq
cpufreq: Fix policy initialization for internal governor drivers
2020-03-05 16:43:44 +01:00
cpuidle
cpuidle: teo: Avoid using "early hits" incorrectly
2020-02-05 21:22:52 +00:00
crypto
crypto: chtls - Fixed memory leak
2020-02-24 08:36:40 +01:00
dax
…
dca
…
devfreq
Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
2020-03-05 16:43:43 +01:00
dio
…
dma
Revert "dmaengine: imx-sdma: Fix memory leak"
2020-02-28 17:22:24 +01:00
dma-buf
dma-buf: Fix memory leak in sync_file_merge()
2019-12-21 11:04:48 +01:00
edac
EDAC: skx_common: downgrade message importance on missing PCI device
2020-03-05 16:43:31 +01:00
eisa
…
extcon
extcon-intel-cht-wc: Don't reset USB data connection at probe
2020-02-01 09:34:46 +00:00
firewire
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
firmware
firmware: arm_scmi: Fix doorbell ring logic for !CONFIG_64BIT
2020-01-26 10:01:07 +01:00
fpga
Merge tag 'char-misc-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2019-09-18 11:14:31 -07:00
fsi
fsi: core: Fix small accesses and unaligned offsets via sysfs
2019-12-31 16:45:09 +01:00
gnss
…
gpio
gpiolib: Set lockdep class for hierarchical irq domains
2020-02-24 08:36:49 +01:00
gpu
amdgpu/gmc_v9: save/restore sdpif regs during S3
2020-03-05 16:43:43 +01:00
greybus
staging: greybus: move es2 to drivers/greybus/
2019-08-27 19:03:08 +02:00
hid
HID: hiddev: Fix race in in hiddev_disconnect()
2020-03-05 16:43:45 +01:00
hsi
Merge tag 'hsi-for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi
2019-09-22 12:02:21 -07:00
hv
hv_balloon: Balloon up according to request page number
2020-02-11 04:35:21 -08:00
hwmon
hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
2020-02-19 19:53:07 +01:00
hwspinlock
…
hwtracing
intel_th: msu: Fix window switching without windows
2019-12-31 16:46:09 +01:00
i2c
i2c: stm32f7: report dma error during probe
2020-01-26 10:01:06 +01:00
i3c
i3c: master: Use dev_to_i3cmaster()
2019-08-27 09:43:59 +02:00
ide
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-24 08:36:53 +01:00
idle
x86/intel: Aggregate microserver naming
2019-08-28 11:29:32 +02:00
iio
iio: st_gyro: Correct data for LSM9DS0 gyro
2020-02-01 09:34:36 +00:00
infiniband
RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready()
2020-03-05 16:43:38 +01:00
input
Input: edt-ft5x06 - work around first register access error
2020-02-24 08:36:45 +01:00
interconnect
interconnect: qcom: qcs404: Walk the list safely on node removal
2019-12-17 19:55:39 +01:00
iommu
iommu/qcom: Fix bogus detach logic
2020-02-28 17:22:12 +01:00
ipack
…
irqchip
irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
2020-02-24 08:37:01 +01:00
isdn
net: use skb_queue_empty_lockless() in poll() handlers
2019-10-28 13:33:41 -07:00
leds
leds: pca963x: Fix open-drain initialization
2020-02-24 08:36:24 +01:00
lightnvm
lightnvm: print error when target is not found
2019-09-05 13:17:01 -06:00
macintosh
macintosh: therm_windtunnel: fix regression when instantiating devices
2020-03-05 16:43:43 +01:00
mailbox
mailbox: imx: Fix Tx doorbell shutdown path
2020-01-04 19:18:30 +01:00
mcb
…
md
bcache: properly initialize 'path' and 'err' in register_bcache()
2020-02-24 08:37:03 +01:00
media
media: uvcvideo: Add a quirk to force GEO GC6500 Camera bits-per-pixel value
2020-02-24 08:36:56 +01:00
memory
memory: mtk-smi: Add PM suspend and resume ops
2020-01-17 19:48:59 +01:00
memstick
memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
2019-10-09 11:08:03 +02:00
message
scsi: mptfusion: Fix double fetch bug in ioctl
2020-01-23 08:22:35 +01:00
mfd
mfd: max77650: Select REGMAP_IRQ in Kconfig
2020-02-14 16:34:19 -05:00
misc
misc: xilinx_sdfec: fix xsdfec_poll()'s return type
2020-02-24 08:36:47 +01:00
mmc
mmc: core: Rework wp-gpio handling
2020-02-19 19:53:10 +01:00
mtd
mtd: sharpslpart: Fix unsigned comparison to zero
2020-02-14 16:34:18 -05:00
mux
…
net
net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples()
2020-03-05 16:43:41 +01:00
nfc
nfc: pn544: Fix occasional HW initialization failure
2020-03-05 16:43:32 +01:00
ntb
NTB: fix IDT Kconfig typos/spellos
2019-09-23 17:20:40 -04:00
nubus
…
nvdimm
libnvdimm/btt: fix variable 'rc' set but not used
2020-01-04 19:18:12 +01:00
nvme
nvme/pci: move cqe check after device shutdown
2020-03-05 16:43:41 +01:00
nvmem
nvmem: core: fix memory abort in cleanup path
2020-02-11 04:35:21 -08:00
of
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
2020-02-11 04:35:25 -08:00
opp
opp: Free static OPPs on errors while adding them
2020-02-24 08:36:34 +01:00
oprofile
…
parisc
parisc: Remove 32-bit DMA enforcement from sba_iommu
2019-10-14 21:44:26 +02:00
parport
parport: load lowlevel driver if ports not found
2019-12-31 16:45:25 +01:00
pci
PCI: Add DMA alias quirk for PLX PEX NTB
2020-02-24 08:36:37 +01:00
pcmcia
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
perf
perf/smmuv3: Use platform_get_irq_optional() for wired interrupt
2020-03-05 16:43:37 +01:00
phy
phy: qualcomm: Adjust indentation in read_poll_timeout
2020-02-11 04:35:45 -08:00
pinctrl
pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
2020-02-24 08:36:41 +01:00
platform
platform/x86: intel_mid_powerbtn: Take a copy of ddata
2020-02-14 16:34:12 -05:00
pnp
…
power
power: supply: ltc2941-battery-gauge: fix use-after-free
2020-02-11 04:35:24 -08:00
powercap
powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online()
2020-01-14 20:08:18 +01:00
pps
…
ps3
…
ptp
ptp: free ptp device pin descriptors properly
2020-01-23 08:22:51 +01:00
pwm
pwm: Remove set but not set variable 'pwm'
2020-02-24 08:36:53 +01:00
rapidio
…
ras
…
regulator
regulator: core: Fix exported symbols to the exported GPL version
2020-02-24 08:36:54 +01:00
remoteproc
remoteproc: Initialize rproc_class before use
2020-02-24 08:36:54 +01:00
reset
reset: uniphier: Add SCSSI reset control for each channel
2020-02-24 08:36:41 +01:00
rpmsg
rpmsg: char: release allocated memory
2020-01-14 20:08:37 +01:00
rtc
rtc: Kconfig: select REGMAP_I2C when necessary
2020-02-24 08:37:03 +01:00
s390
s390/zcrypt: fix card and queue total counter wrap
2020-03-05 16:43:36 +01:00
sbus
…
scsi
scsi: iscsi: Don't destroy session if there are outstanding connections
2020-02-24 08:36:50 +01:00
sfi
…
sh
…
siox
…
slimbus
…
soc
soc/tegra: fuse: Fix build with Tegra194 configuration
2020-03-05 16:43:39 +01:00
soundwire
soundwire: intel: fix PDI/stream mapping for Bulk
2019-12-31 16:45:11 +01:00
spi
spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations
2020-02-24 08:36:54 +01:00
spmi
spmi: pmic-arb: Set lockdep class for hierarchical irq domains
2020-02-19 19:53:07 +01:00
ssb
ssb: make array pwr_info_offset static const, makes object smaller
2019-09-13 17:23:18 +03:00
staging
staging: greybus: use after free in gb_audio_manager_remove_all()
2020-02-28 17:22:26 +01:00
target
scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
2020-02-28 17:22:25 +01:00
tc
…
tee
tee: optee: Fix compilation issue with nommu
2020-02-05 21:22:49 +00:00
thermal
thermal: Fix deadlock in thermal thermal_zone_device_check
2019-12-13 08:43:21 +01:00
thunderbolt
thunderbolt: Prevent crash if non-active NVMem file is read
2020-02-28 17:22:13 +01:00
tty
serdev: ttyport: restore client ops on deregistration
2020-02-28 17:22:19 +01:00
uio
uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
2020-02-24 08:36:27 +01:00
usb
usb: dwc2: Fix in ISOC request length checking
2020-02-28 17:22:26 +01:00
vfio
vfio/spapr/nvlink2: Skip unpinning pages on error exit
2020-02-24 08:36:43 +01:00
vhost
vhost: Check docket sk_family instead of call getname
2020-03-05 16:43:44 +01:00
video
pxa168fb: Fix the function used to release some memory in an error handling path
2020-02-24 08:36:25 +01:00
virt
virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
2019-10-10 14:50:32 +02:00
virtio
virtio_balloon: prevent pfn array overflow
2020-02-24 08:37:03 +01:00
visorbus
visorbus: fix uninitialized variable access
2020-02-24 08:36:47 +01:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-24 08:36:48 +01:00
w1
w1: ds250x: Fix build error without CRC16
2019-10-10 15:35:41 +02:00
watchdog
ACPI: watchdog: Fix gas->access_width usage
2020-03-05 16:43:42 +01:00
xen
xen: Enable interrupts when calling _cond_resched()
2020-02-28 17:22:28 +01:00
zorro
…
Kconfig
Merge tag 'staging-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
2019-09-18 11:05:34 -07:00
Makefile
Merge tag 'staging-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
2019-09-18 11:05:34 -07:00