shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-25 03:50:24 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
bdcb1d7cf285a024dedef2863b661517a87c72cc
linux/drivers
History
Hyunwoo Kim e504729496 fbdev: smscufx: Fix use-after-free in ufx_ops_open() 
commit 5610bcfe86 upstream.

A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 13:25:11 +02:00
..
accessibility
tty: the rest, stop using tty_schedule_flip()
2022-07-29 17:19:28 +02:00
acpi
ACPI: processor: Remove freq Qos request for all CPUs
2022-08-31 17:15:23 +02:00
amba
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
android
binder: fix UAF of ref->proc caused by race condition
2022-09-08 11:11:38 +02:00
ata
libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205
2022-10-05 10:38:39 +02:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:38:02 +02:00
auxdisplay
auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-18 14:04:24 +01:00
base
driver core: Don't probe devices after bus_type.match() probe deferral
2022-09-08 11:11:40 +02:00
bcma
bcma: Fix memory leak for internally-handled cores
2021-09-15 09:50:45 +02:00
block
xen-blkfront: Cache feature_persistent value before advertisement
2022-09-15 11:32:02 +02:00
bluetooth
Bluetooth: hci_intel: Add check for platform_driver_register
2022-08-21 15:15:49 +02:00
bus
bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
2022-08-21 15:15:35 +02:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 12:06:55 +02:00
char
random: use expired timer rather than wq for mixing fast pool
2022-10-15 07:55:55 +02:00
clk
Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
2022-10-15 07:55:54 +02:00
clocksource
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
2022-07-07 17:52:23 +02:00
connector
…
counter
counter: stm32-lptimer-cnt: remove iio counter abi
2022-01-27 10:54:08 +01:00
cpufreq
cpufreq: pmac32-cpufreq: Fix refcount leak bug
2022-07-21 21:20:14 +02:00
cpuidle
cpuidle: Fix kobject memory leaks in error paths
2021-11-18 14:04:05 +01:00
crypto
crypto: hisilicon/sec - fix auth key size error
2022-08-21 15:15:50 +02:00
dax
devdax: Fix soft-reservation memory description
2022-09-28 11:10:41 +02:00
dca
…
devfreq
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
2022-07-07 17:52:18 +02:00
dio
…
dma
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
2022-10-15 07:55:52 +02:00
dma-buf
udmabuf: Set the DMA mask for the udmabuf device (v2)
2022-09-05 10:28:55 +02:00
edac
EDAC/ghes: Set the DIMM label unconditionally
2022-08-03 12:00:50 +02:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 18:32:43 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:25:32 +02:00
firmware
firmware: arm_scmi: Add SCMI PM driver remove routine
2022-10-15 07:55:51 +02:00
fpga
fpga: altera-pr-ip: fix unsigned comparison with less than zero
2022-08-21 15:15:53 +02:00
fsi
fsi: Aspeed: Fix a potential double free
2022-04-08 14:40:23 +02:00
gnss
…
gpio
gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
2022-09-28 11:10:27 +02:00
gpu
drm/udl: Restore display mode on resume
2022-10-26 13:25:10 +02:00
greybus
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-08 14:39:50 +02:00
hid
HID: multitouch: Add memory barriers
2022-10-26 13:25:09 +02:00
hsi
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 10:54:12 +01:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 11:10:39 +02:00
hwmon
hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
2022-10-26 13:25:09 +02:00
hwspinlock
…
hwtracing
intel_th: pci: Add Raptor Lake-S CPU support
2022-08-21 15:16:17 +02:00
i2c
i2c: mlxbf: Fix frequency calculation
2022-09-28 11:10:40 +02:00
i3c
Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
2021-05-14 09:50:05 +02:00
ide
ide/falconide: Fix module unload
2021-03-04 11:38:21 +01:00
idle
intel_idle: Disable IBRS during long idle
2022-07-25 11:26:43 +02:00
iio
iio: pressure: dps310: Reset chip after timeout
2022-10-26 13:25:07 +02:00
infiniband
RDMA/mlx5: Set local port to one when accessing counters
2022-09-15 11:32:06 +02:00
input
Input: xpad - fix wireless 360 controller breaking after suspend
2022-10-15 07:55:56 +02:00
interconnect
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
2022-09-28 11:10:28 +02:00
iommu
iommu/vt-d: Check correct capability for sagaw determination
2022-09-28 11:10:26 +02:00
ipack
ipack: ipoctal: fix module reference leak
2021-10-06 15:56:01 +02:00
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:38:12 +02:00
isdn
isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
2022-03-16 14:15:57 +01:00
leds
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
2021-09-15 09:50:36 +02:00
lightnvm
lightnvm: disable the subsystem
2022-05-09 09:04:56 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 13:06:47 +02:00
mailbox
mailbox: forward the hrtimer if not queued and under a lock
2022-06-09 10:21:18 +02:00
mcb
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:11:00 +02:00
md
md: call __md_stop_writes in md_stop
2022-08-31 17:15:23 +02:00
media
media: dvb_vb2: fix possible out of bound access
2022-10-05 10:38:40 +02:00
memory
memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
2022-06-29 08:59:54 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-21 15:15:58 +02:00
message
…
mfd
mfd: max77620: Fix refcount leak in max77620_initialise_fps
2022-08-21 15:16:09 +02:00
misc
misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
2022-10-15 07:55:57 +02:00
mmc
mmc: sdhci-sprd: Fix minimum clock limit
2022-10-26 13:25:08 +02:00
most
most: fix control-message timeouts
2021-11-18 14:03:51 +01:00
mtd
mtd: rawnand: atmel: Unmap streaming DMA mappings
2022-10-26 13:25:07 +02:00
mux
…
net
can: kvaser_usb_leaf: Fix CAN state after restart
2022-10-26 13:25:08 +02:00
nfc
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
2022-08-31 17:15:16 +02:00
ntb
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:38:01 +02:00
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:52:15 +02:00
nvme
nvme-pci: set min_align_mask before calculating max_hw_sectors
2022-10-26 13:25:10 +02:00
nvmem
nvmem: core: set size for sysfs bin file
2022-01-27 10:54:22 +01:00
of
of: fdt: fix off-by-one error in unflatten_dt_nodes()
2022-09-23 14:16:57 +02:00
opp
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-21 15:16:04 +02:00
oprofile
…
parisc
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
2022-09-23 14:16:58 +02:00
parport
parport: remove non-zero check on count
2021-09-18 13:40:34 +02:00
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 13:25:11 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 18:32:30 +02:00
perf
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
2022-09-20 12:38:32 +02:00
phy
phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
2022-06-14 18:32:32 +02:00
pinctrl
pinctrl: sunxi: Fix name for A100 R_PIO
2022-09-23 14:16:57 +02:00
platform
platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
2022-10-26 13:25:09 +02:00
pnp
…
power
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
2022-07-29 17:19:10 +02:00
powercap
powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
2022-10-26 13:25:11 +02:00
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-13 21:00:55 +02:00
pwm
pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource()
2022-08-21 15:15:37 +02:00
rapidio
rapidio: handle create_workqueue() failure
2021-05-26 12:06:52 +02:00
ras
RAS/CEC: Correct ce_add_elem()'s returned values
2021-04-14 08:42:12 +02:00
regulator
regulator: qcom_rpm: Fix circular deferral regression
2022-10-26 13:25:09 +02:00
remoteproc
remoteproc: sysmon: Wait for SSCTL service to come up
2022-08-21 15:16:08 +02:00
reset
reset: imx7: Fix the iMX8MP PCIe PHY PERST support
2022-10-05 10:38:40 +02:00
rpmsg
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-15 07:55:54 +02:00
rtc
rtc: mt6397: check return value after calling platform_get_resource()
2022-06-14 18:32:33 +02:00
s390
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
2022-09-28 11:10:38 +02:00
sbus
…
scsi
scsi: qedf: Populate sysfs attributes for vport
2022-10-26 13:25:11 +02:00
sfi
…
sh
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:39:12 +01:00
siox
…
slimbus
slimbus: qcom: Fix IRQ check in qcom_slim_probe
2022-05-18 10:23:47 +02:00
soc
soc: sunxi: sram: Fix debugfs info for A64 SRAM C
2022-10-05 10:38:41 +02:00
soundwire
soundwire: bus_type: fix remove and shutdown support
2022-08-21 15:15:56 +02:00
spi
spi: meson-spicc: add local pow2 clock ops to preserve rate between messages
2022-08-25 11:38:06 +02:00
spmi
spmi: spmi-pmic-arb: Fix hw_irq overflow
2021-03-04 11:38:40 +01:00
ssb
ssb: Fix error return code in ssb_bus_scan()
2021-07-14 16:56:21 +02:00
staging
media: rkvdec: Disable H.264 error detection
2022-10-05 10:38:40 +02:00
target
target: remove an incorrect unmap zeroes data deduction
2022-06-09 10:21:01 +02:00
tc
…
tee
tee: fix compiler warning in tee_shm_register()
2022-09-15 11:32:04 +02:00
thermal
thermal: sysfs: Fix cooling_device_stats_setup() error code path
2022-08-21 15:15:22 +02:00
thunderbolt
thunderbolt: Explicitly reset plug events delay back to USB4 spec value
2022-10-05 10:38:38 +02:00
tty
serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting
2022-09-28 11:10:38 +02:00
uio
uio_hv_generic: Fix a memory leak in error handling paths
2021-05-26 12:06:52 +02:00
usb
usb: add quirks for Lenovo OneLink+ Dock
2022-10-26 13:25:08 +02:00
vdpa
vdpasim: allow to enable a vq repeatedly
2022-06-09 10:21:29 +02:00
vfio
vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
2022-09-28 11:10:38 +02:00
vhost
vringh: Fix loop descriptors check in the indirect cases
2022-06-14 18:32:45 +02:00
video
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
2022-10-26 13:25:11 +02:00
virt
vboxguest: Do not use devm for irq
2022-08-25 11:38:14 +02:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 21:20:13 +02:00
visorbus
visorbus: fix error return code in visorchipset_init()
2021-07-14 16:56:41 +02:00
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-13 21:01:01 +02:00
watchdog
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-21 15:16:10 +02:00
xen
xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
2022-09-08 11:11:38 +02:00
zorro
…
Kconfig
…
Makefile
…