malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity
msm-4.14/drivers
History
Ilya Dryomov 71da2a151e rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails 
commit f7c4d9b133c7a04ca619355574e96b6abf209fba upstream.

If getting an ID or setting up a work queue in rbd_dev_create() fails,
use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts
is triggered in do_rbd_add().  The root cause is that the ownership of
these structures is transfered to rbd_dev prematurely and they all end
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to
returning to do_rbd_add().

Found by Linux Verification Center (linuxtesting.org) with SVACE, an
incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>.

Cc: stable@vger.kernel.org
Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-11 16:26:48 +01:00
..
accessibility
…
acpi
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
2023-03-11 16:26:42 +01:00
amba
…
android
binder: fix UAF of ref->proc caused by race condition
2022-09-15 12:23:50 +02:00
ata
ata: pata_legacy: fix pdc20230_set_piomode()
2022-11-10 15:47:20 +01:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:11:33 +02:00
auxdisplay
…
base
driver core: Fix bus_type.match() error handling in __driver_attach()
2023-01-18 09:26:42 +01:00
bcma
…
block
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
2023-03-11 16:26:48 +01:00
bluetooth
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 09:26:20 +01:00
bus
bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
2023-02-22 12:46:01 +01:00
cdrom
…
char
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
2023-01-18 09:26:36 +01:00
clk
clk: st: Fix memory leak in st_of_quadfs_setup()
2023-01-18 09:26:33 +01:00
clocksource
clocksource/drivers/sp804: Avoid error on multiple instances
2022-06-14 16:54:00 +02:00
connector
…
cpufreq
cpufreq: davinci: Fix clk use after free
2023-03-11 16:26:37 +01:00
cpuidle
cpuidle: dt: Return the correct numbers of parsed idle states
2023-01-18 09:26:09 +01:00
crypto
crypto: n2 - add missing hash statesize
2023-01-18 09:26:38 +01:00
dax
…
dca
…
devfreq
…
dio
drivers: dio: fix possible memory leak in dio_init()
2023-01-18 09:26:22 +01:00
dma
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
2023-03-11 16:26:33 +01:00
dma-buf
…
edac
EDAC/device: Respect any driver-supplied workqueue polling value
2023-02-06 07:46:31 +01:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 16:54:00 +02:00
firewire
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
2023-02-22 12:46:01 +01:00
firmware
efi: Accept version 2 of memory attributes table
2023-02-22 12:46:02 +01:00
fmc
…
fpga
fpga: altera-pr-ip: fix unsigned comparison with less than zero
2022-08-25 11:11:21 +02:00
fsi
fsi: core: Check error number after calling ida_simple_get
2022-10-26 13:17:06 +02:00
gpio
gpio: vf610: connect GPIO label to dev name
2023-03-11 16:26:39 +01:00
gpu
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
2023-03-11 16:26:42 +01:00
hid
HID: asus: use spinlock to safely schedule workers
2023-03-11 16:26:33 +01:00
hsi
HSI: omap_ssi_core: Fix error handling in ssi_init()
2023-01-18 09:26:26 +01:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 10:56:52 +02:00
hwmon
hwmon: (ltc2945) Handle error case in ltc2945_value_store
2023-03-11 16:26:39 +01:00
hwspinlock
…
hwtracing
intel_th: pci: Add Meteor Lake-P support
2022-08-25 11:11:29 +02:00
i2c
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
2023-01-18 09:26:25 +01:00
ide
…
idle
entel_idle: Disable IBRS during long idle
2022-11-01 19:14:45 +01:00
iio
iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
2023-02-22 12:46:03 +01:00
infiniband
IB/hfi1: Assign npages earlier
2023-03-11 16:26:32 +01:00
input
Input: ads7846 - don't check penirq immediately for 7845
2023-03-11 16:26:40 +01:00
iommu
iommu/amd: Fix ivrs_acpihid cmdline parsing code
2023-01-18 09:26:38 +01:00
ipack
…
irqchip
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
2023-03-11 16:26:38 +01:00
isdn
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
2023-01-18 09:26:28 +01:00
leds
…
lightnvm
lightnvm: disable the subsystem
2022-05-12 12:17:04 +02:00
macintosh
macintosh/macio-adb: check the return value of ioremap()
2023-01-18 09:26:27 +01:00
mailbox
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
2022-10-26 13:17:07 +02:00
mcb
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
2023-01-18 09:26:24 +01:00
md
dm flakey: don't corrupt the zero page
2023-03-11 16:26:47 +01:00
media
media: usb: siano: Fix use after free bugs caused by do_submit_urb
2023-03-11 16:26:40 +01:00
memory
memory: of: Fix refcount leak bug in of_get_ddr_timings()
2022-10-26 13:17:02 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-25 11:11:21 +02:00
message
…
mfd
mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
2023-03-11 16:26:39 +01:00
misc
cxl: Fix refcount leak in cxl_calc_capp_routing
2023-01-18 09:26:27 +01:00
mmc
mmc: sdio: fix possible resource leaks in some error paths
2023-02-22 12:46:05 +01:00
mtd
mtd: rawnand: sunxi: Fix the size of the last OOB region
2023-03-11 16:26:40 +01:00
mux
…
net
wifi: rtl8xxxu: Use a longer retry limit of 48
2023-03-11 16:26:47 +01:00
nfc
nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
2023-01-18 09:26:43 +01:00
ntb
…
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:31:16 +02:00
nvme
nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
2023-02-22 12:46:05 +01:00
nvmem
…
of
of: property: decrement node refcount in of_fwnode_get_reference_args()
2022-12-08 11:16:31 +01:00
oprofile
…
parisc
parisc: led: Fix potential null-ptr-deref in start_task()
2023-01-18 09:26:38 +01:00
parport
parport_pc: Avoid FIFO port location truncation
2022-11-25 17:36:50 +01:00
pci
PCI/sysfs: Fix double free in error path
2023-01-18 09:26:38 +01:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 16:53:55 +02:00
perf
perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
2022-04-20 09:08:30 +02:00
phy
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
2023-02-06 07:46:28 +01:00
pinctrl
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
2023-03-11 16:26:43 +01:00
platform
platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
2023-01-18 09:26:43 +01:00
pnp
PNP: fix name memory leak in pnp_alloc_dev()
2023-01-18 09:26:10 +01:00
power
power: supply: fix residue sysfs file in error handle route of __power_supply_register()
2023-01-18 09:26:26 +01:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:17:08 +02:00
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-20 09:08:26 +02:00
pwm
pwm: lp3943: Fix duty calculation in case period was clamped
2022-06-14 16:53:56 +02:00
rapidio
rapidio: devices: fix missing put_device in mport_cdev_open
2023-01-18 09:26:12 +01:00
ras
…
regulator
regulator: s5m8767: Bounds check id indexing into arrays
2023-03-11 16:26:43 +01:00
remoteproc
remoteproc: qcom: wcnss: Fix handling of IRQs
2022-08-25 11:11:24 +02:00
reset
…
rpmsg
rpmsg: glink: Avoid infinite loop on intent for missing channel
2023-03-11 16:26:41 +01:00
rtc
rtc: pm8xxx: fix set-alarm race
2023-03-11 16:26:44 +01:00
s390
s390/lcs: Fix return type of lcs_start_xmit()
2023-01-18 09:26:31 +01:00
sbus
…
scsi
scsi: aic94xx: Add missing check for dma_map_single()
2023-03-11 16:26:39 +01:00
sfi
…
sh
…
sn
…
soc
ARM: ux500: do not directly dereference __iomem
2023-01-18 09:26:36 +01:00
spi
spi: bcm63xx-hsspi: Fix multi-bit mode setting
2023-03-11 16:26:43 +01:00
spmi
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 13:17:07 +02:00
ssb
…
staging
comedi: adv_pci1760: Fix PWM instruction handling
2023-02-06 07:46:30 +01:00
target
scsi: target: core: Fix warning on RT kernels
2023-02-22 12:46:01 +01:00
tc
…
tee
…
thermal
thermal: intel: Fix unsigned comparison with less than zero
2023-03-11 16:26:41 +01:00
thunderbolt
thunderbolt: Use the actual buffer in tb_async_error()
2022-09-15 12:23:50 +02:00
tty
serial: 8250_dma: Fix DMA Rx rearm race
2023-02-22 12:46:03 +01:00
uio
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
2023-01-18 09:26:23 +01:00
usb
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
2023-03-11 16:26:33 +01:00
uwb
…
vfio
vfio: platform: Do not pass return buffer to ACPI _RST method
2023-01-18 09:26:23 +01:00
vhost
vhost/vsock: Use kvmalloc/kvfree for larger packets.
2022-10-26 13:17:00 +02:00
video
fbcon: Check font dimension limits
2023-02-22 12:46:02 +01:00
virt
…
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 20:42:46 +02:00
vlynq
…
vme
vme: Fix error not catched in fake_init()
2023-01-18 09:26:25 +01:00
w1
w1: fix WARNING after calling w1_process()
2023-02-06 07:46:30 +01:00
watchdog
watchdog: diag288_wdt: fix __diag288() inline assembly
2023-02-22 12:46:02 +01:00
xen
xen/platform-pci: add missing free_irq() in error path
2022-12-08 11:16:31 +01:00
zorro
…
Kconfig
…
Makefile
…