shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-11 05:17:10 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
c5875ea6efcb81e0419f9edbac4f4412d5867221
linux/drivers
History
Hyunwoo Kim 347a969b13 fbdev: smscufx: Fix use-after-free in ufx_ops_open() 
commit 5610bcfe86 upstream.

A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 13:15:37 +02:00
..
accessibility
…
acpi
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
2022-08-25 11:09:22 +02:00
amba
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-12 13:18:01 +01:00
android
binder: use wake_up_pollfree()
2021-12-14 10:04:48 +01:00
ata
ata: libata-eh: Add missing command name
2022-08-25 11:09:28 +02:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:09:29 +02:00
auxdisplay
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
2021-11-26 11:48:38 +01:00
base
driver core: Don't probe devices after bus_type.match() probe deferral
2022-09-15 12:39:46 +02:00
bcma
bcma: Fix memory leak for internally-handled cores
2021-09-22 11:43:02 +02:00
block
loop: Check for overflow while configuring loop
2022-09-05 10:23:56 +02:00
bluetooth
Bluetooth: bfusb: fix division by zero in send path
2022-01-27 08:47:30 +01:00
bus
bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
2022-05-12 12:14:55 +02:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:29:07 +02:00
char
random: use expired timer rather than wq for mixing fast pool
2022-10-26 13:15:36 +02:00
clk
clk: iproc: Do not rely on node name for correct PLL setup
2022-10-26 13:15:33 +02:00
clocksource
clocksource/drivers/sp804: Avoid error on multiple instances
2022-06-14 16:52:40 +02:00
connector
…
cpufreq
cpufreq: pmac32-cpufreq: Fix refcount leak bug
2022-07-21 20:40:31 +02:00
cpuidle
cpuidle: Fix kobject memory leaks in error paths
2021-11-26 11:48:33 +01:00
crypto
crypto: ccp - ccp_dmaengine_unregister release dma channels
2022-04-20 09:06:31 +02:00
dax
…
dca
…
devfreq
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 20:40:02 +02:00
dio
…
dma
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
2022-10-26 13:15:34 +02:00
dma-buf
…
edac
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
2022-02-23 11:56:41 +01:00
eisa
…
extcon
extcon: max8997: Add missing modalias string
2021-07-20 16:21:05 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:14:57 +02:00
firmware
firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
2022-06-14 16:52:38 +02:00
fmc
…
fpga
…
gpio
MIPS: Remove repetitive increase irq_err_count
2022-07-02 16:17:14 +02:00
gpu
Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
2022-10-26 13:15:32 +02:00
hid
HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
2022-09-20 11:50:15 +02:00
hsi
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 08:47:37 +01:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 10:55:47 +02:00
hwmon
hwmon: (gpio-fan) Fix array out of bounds access
2022-09-15 12:39:44 +02:00
hwspinlock
…
hwtracing
coresight: Fix TRCCONFIGR.QE sysfs interface
2022-04-20 09:06:28 +02:00
i2c
i2c: cadence: Change large transfer count reset logic to be unconditional
2022-07-29 17:05:46 +02:00
ide
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
idle
…
iio
iio: dac: ad5593r: Fix i2c read protocol requirements
2022-10-26 13:15:36 +02:00
infiniband
RDMA/rxe: Generate a completion for unsupported/invalid opcode
2022-06-14 16:52:36 +02:00
input
Input: xpad - fix wireless 360 controller breaking after suspend
2022-10-26 13:15:36 +02:00
iommu
iommu/vt-d: Fix PCI bus rescan device hot add
2022-07-12 16:26:24 +02:00
ipack
ipack: ipoctal: fix module reference leak
2021-10-06 10:23:42 +02:00
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:09:30 +02:00
isdn
mISDN: change function names to avoid conflicts
2022-01-11 13:38:13 +01:00
leds
leds: ktd2692: Fix an error handling path
2021-07-20 16:21:05 +02:00
lguest
…
lightnvm
lightnvm: disable the subsystem
2022-05-12 12:14:53 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-25 11:09:23 +02:00
mailbox
…
mcb
mcb: fix error handling in mcb_alloc_bus()
2021-10-06 10:23:39 +02:00
md
drivers:md:fix a potential use-after-free bug
2022-08-25 11:09:31 +02:00
media
media: pvrusb2: fix memory leak in pvr_probe
2022-09-05 10:23:57 +02:00
memory
memory: emif: check the pointer temp in get_device_details()
2022-04-20 09:06:33 +02:00
memstick
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-26 11:48:34 +01:00
message
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-10 10:23:57 +01:00
mfd
misc: rtsx_usb: set return value in rsp_buf alloc err path
2022-07-29 17:05:45 +02:00
misc
cxl: Fix a memory leak in an error handling path
2022-08-25 11:09:31 +02:00
mmc
mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
2022-10-26 13:15:32 +02:00
mtd
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
2022-06-14 16:52:41 +02:00
net
wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
2022-10-26 13:15:35 +02:00
nfc
NFC: nxp-nci: don't print header length mismatch on i2c error
2022-07-21 20:40:32 +02:00
ntb
NTB: hw: amd: fix an issue about leak system resources
2020-10-29 09:05:41 +01:00
nubus
…
nvdimm
libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-03 17:44:44 +01:00
nvme
nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
2022-10-26 13:15:33 +02:00
nvmem
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-27 09:33:58 +02:00
of
fdt: Update CRC check for rng-seed
2022-07-02 16:17:16 +02:00
oprofile
…
parisc
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
2022-09-28 10:55:44 +02:00
parport
parport: remove non-zero check on count
2021-09-22 11:43:07 +02:00
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 13:15:37 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 16:52:36 +02:00
perf
…
phy
phy: samsung: exynos5250-sata: fix missing device put in probe error paths
2022-05-12 12:14:54 +02:00
pinctrl
pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
2022-08-25 11:09:29 +02:00
platform
platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
2022-09-20 11:50:15 +02:00
pnp
…
power
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
2022-07-29 17:05:45 +02:00
powercap
powercap: restrict energy meter to root access
2020-11-10 21:04:57 +01:00
pps
…
ps3
powerpc/ps3: use dma_mapping_error()
2020-12-29 13:45:00 +01:00
ptp
ptp: replace snprintf with sysfs_emit
2022-04-20 09:06:42 +02:00
pwm
pwm: lp3943: Fix duty calculation in case period was clamped
2022-06-14 16:52:37 +02:00
rapidio
rapidio: handle create_workqueue() failure
2021-05-26 11:29:06 +02:00
ras
…
regulator
regulator: qcom_rpm: Fix circular deferral regression
2022-10-26 13:15:37 +02:00
remoteproc
remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
2022-04-20 09:06:36 +02:00
reset
reset: ti-syscon: fix to_ti_syscon_reset_data macro
2021-07-28 09:14:24 +02:00
rpmsg
rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
2022-06-14 16:52:37 +02:00
rtc
rtc: mt6397: check return value after calling platform_get_resource()
2022-06-14 16:52:37 +02:00
s390
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
2022-09-28 10:55:46 +02:00
sbus
…
scsi
scsi: stex: Properly zero out the passthrough command structure
2022-10-26 13:15:35 +02:00
sfi
…
sh
maple: fix wrong return value of maple_bus_init().
2021-11-26 11:48:41 +01:00
sn
…
soc
soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
2022-06-14 16:52:33 +02:00
spi
spi: img-spfi: Fix pm_runtime_get_sync() error checking
2022-06-14 16:52:31 +02:00
spmi
…
ssb
ssb: sdio: Don't overwrite const buffer if block_write fails
2021-07-20 16:20:57 +02:00
staging
staging: rtl8712: fix use after free bugs
2022-09-15 12:39:44 +02:00
target
scsi: target: iscsi: Make sure the np under each tpg is unique
2022-02-16 12:43:53 +01:00
tc
…
thermal
thermal: int340x: Increase bitmap size
2022-04-20 09:06:30 +02:00
thunderbolt
…
tty
serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting
2022-09-28 10:55:46 +02:00
uio
…
usb
USB: serial: qcserial: add new usb-id for Dell branded EM7455
2022-10-26 13:15:35 +02:00
uwb
…
vfio
vfio: Clear the caps->buf to NULL after free
2022-08-25 11:09:31 +02:00
vhost
vringh: Fix loop descriptors check in the indirect cases
2022-06-14 16:52:41 +02:00
video
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
2022-10-26 13:15:37 +02:00
virt
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:05:35 +01:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 20:40:31 +02:00
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-20 09:06:43 +02:00
watchdog
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
2021-11-26 11:48:38 +01:00
xen
xen/xenbus: fix return type in xenbus_file_read()
2022-08-25 11:09:29 +02:00
zorro
…
Kconfig
…
Makefile
…