android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
68bcd06385
android_kernel_xiaomi_sm8450/drivers
History
Rob Clark 68bcd06385 drm/virtio: Fix GEM handle creation UAF 
[ Upstream commit 52531258318ed59a2dc5a43df2eaf0eb1d65438e ]

Userspace can guess the handle value and try to race GEM object creation
with handle close, resulting in a use-after-free if we dereference the
object after dropping the handle's reference.  For that reason, dropping
the handle's reference must be done *after* we are done dereferencing
the object.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
Fixes: 62fb7a5e10 ("virtio-gpu: add 3d/virgl support")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221216233355.542197-2-robdclark@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-18 11:45:01 +01:00
..
accessibility speakup: fix a segfault caused by switching consoles 2022-11-25 17:45:50 +01:00
acpi ACPICA: Fix error code path in acpi_ds_call_control_method() 2023-01-14 10:16:14 +01:00
amba
android file: Rename __close_fd_get_file close_fd_get_file 2023-01-04 11:39:18 +01:00
ata ata: ahci: Fix PCS quirk application for suspend 2023-01-14 10:16:25 +01:00
atm atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-25 11:38:02 +02:00
auxdisplay
base driver core: Fix bus_type.match() error handling in __driver_attach() 2023-01-14 10:16:36 +01:00
bcma
block drbd: fix an invalid memory access caused by incorrect use of list iterator 2023-01-14 10:15:32 +01:00
bluetooth Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() 2023-01-14 10:15:45 +01:00
bus bus: mhi: host: Fix race between channel preparation and M0 event 2023-01-18 11:44:55 +01:00
cdrom
char ipmi: fix use after free in _ipmi_destroy_user() 2023-01-14 10:16:35 +01:00
clk clk: imx: imx8mp: add shared clk gate for usb suspend clk 2023-01-18 11:44:56 +01:00
clocksource clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() 2023-01-14 10:15:20 +01:00
connector
counter counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update 2023-01-14 10:15:58 +01:00
cpufreq cpufreq: Init completion before kobject_init_and_add() 2023-01-14 10:16:31 +01:00
cpuidle cpuidle: dt: Return the correct numbers of parsed idle states 2023-01-14 10:15:15 +01:00
crypto crypto: n2 - add missing hash statesize 2023-01-14 10:16:36 +01:00
dax devdax: Fix soft-reservation memory description 2022-09-28 11:10:41 +02:00
dca
devfreq PM/devfreq: governor: Add a private governor_data for governor 2023-01-14 10:16:31 +01:00
dio drivers: dio: fix possible memory leak in dio_init() 2023-01-14 10:15:54 +01:00
dma dmaengine: at_hdmac: Check return code of dma_async_device_register 2022-11-16 09:57:20 +01:00
dma-buf dma-buf: fix racing conflict of dma_heap_add() 2022-12-02 17:40:01 +01:00
edac EDAC/device: Fix period calculation in edac_device_reset_delay_period() 2023-01-18 11:44:58 +01:00
eisa
extcon extcon: Modify extcon device to be created after driver data is set 2022-06-14 18:32:43 +02:00
firewire firewire: core: extend card->lock in fw_core_handle_bus_reset 2022-05-12 12:25:32 +02:00
firmware efi: fix NULL-deref in init error path 2023-01-18 11:45:01 +01:00
fpga fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() 2022-10-26 13:25:33 +02:00
fsi fsi: core: Check error number after calling ida_simple_get 2022-10-26 13:25:38 +02:00
gnss
gpio gpio: sifive: Fix refcount leak in sifive_gpio_probe 2023-01-14 10:16:47 +01:00
gpu drm/virtio: Fix GEM handle creation UAF 2023-01-18 11:45:01 +01:00
greybus
hid HID: plantronics: Additional PIDs for double volume key presses quirk 2023-01-14 10:16:26 +01:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2023-01-14 10:16:03 +01:00
hv video: hyperv_fb: Avoid taking busy spinlock on panic path 2023-01-14 10:16:13 +01:00
hwmon hwmon: (jc42) Fix missing unlock on error in jc42_write() 2023-01-14 10:16:20 +01:00
hwspinlock hwspinlock: qcom: correct MMIO max register for newer SoCs 2022-11-16 09:57:07 +01:00
hwtracing coresight: cti: Fix hang in cti_disable_hw() 2022-11-10 18:14:25 +01:00
i2c i2c: ismt: Fix an out-of-bounds bug in ismt_access() 2023-01-14 10:16:00 +01:00
i3c
ide
idle intel_idle: Disable IBRS during long idle 2022-07-25 11:26:43 +02:00
iio iio: adc128s052: add proper .data members in adc128_of_match table 2023-01-14 10:16:24 +01:00
infiniband RDMA/mlx5: Fix validation of max_rd_atomic caps for DC 2023-01-14 10:16:47 +01:00
input Input: elants_i2c - properly handle the reset GPIO when power is off 2023-01-14 10:15:30 +01:00
interconnect interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate 2022-09-28 11:10:28 +02:00
iommu iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() 2023-01-18 11:45:00 +01:00
ipack
irqchip irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() 2023-01-14 10:15:18 +01:00
isdn mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() 2023-01-14 10:16:10 +01:00
leds leds: lm3601x: Don't use mutex after it was destroyed 2022-10-26 13:25:18 +02:00
lightnvm lightnvm: disable the subsystem 2022-05-09 09:04:56 +02:00
macintosh macintosh/macio-adb: check the return value of ioremap() 2023-01-14 10:16:06 +01:00
mailbox mailbox: zynq-ipi: fix error handling while device_register() fails 2023-01-14 10:16:12 +01:00
mcb mcb: mcb-parse: fix error handing in chameleon_parse_gdd() 2023-01-14 10:15:59 +01:00
md md/bitmap: Fix bitmap chunk size overflow issues 2023-01-14 10:16:34 +01:00
media media: s5p-mfc: Fix in register read and write for H264 2023-01-14 10:16:41 +01:00
memory memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() 2022-10-26 13:25:28 +02:00
memstick memstick/ms_block: Fix a memory leak 2022-08-21 15:15:58 +02:00
message
mfd mtd: spi-nor: intel-spi: Disable write protection only if asked 2022-11-25 17:45:41 +01:00
misc cxl: Fix refcount leak in cxl_calc_capp_routing 2023-01-14 10:16:06 +01:00
mmc mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K 2023-01-14 10:16:30 +01:00
most
mtd mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() 2023-01-14 10:16:35 +01:00
mux
net net/mlx5e: Don't support encap rules with gbp option 2023-01-18 11:44:59 +01:00
nfc nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() 2023-01-18 11:44:59 +01:00
ntb NTB: ntb_tool: uninitialized heap data in tool_fn_write() 2022-08-25 11:38:01 +02:00
nubus
nvdimm nvdimm: Fix badblocks clear off-by-one error 2022-07-07 17:52:15 +02:00
nvme nvme: fix multipath crash caused by flush request when blktrace is enabled 2023-01-14 10:16:49 +01:00
nvmem
of of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() 2023-01-14 10:15:42 +01:00
opp opp: Fix error check in dev_pm_opp_attach_genpd() 2022-08-21 15:16:04 +02:00
oprofile
parisc parisc: led: Fix potential null-ptr-deref in start_task() 2023-01-14 10:16:36 +01:00
parport parport_pc: Avoid FIFO port location truncation 2022-11-25 17:45:44 +01:00
pci PCI/sysfs: Fix double free in error path 2023-01-14 10:16:36 +01:00
pcmcia pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards 2022-06-14 18:32:30 +02:00
perf perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() 2023-01-14 10:15:12 +01:00
phy phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices 2023-01-14 10:16:03 +01:00
pinctrl pinctrl: pinconf-generic: add missing of_node_put() 2023-01-14 10:15:32 +01:00
platform platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe 2023-01-18 11:44:54 +01:00
pnp PNP: fix name memory leak in pnp_alloc_dev() 2023-01-14 10:15:17 +01:00
power power: supply: fix null pointer dereferencing in power_supply_get_battery_info 2023-01-14 10:16:03 +01:00
powercap powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue 2022-10-26 13:25:44 +02:00
pps
ps3
ptp ptp: replace snprintf with sysfs_emit 2022-04-13 21:00:55 +02:00
pwm pwm: tegra: Fix 32 bit build 2023-01-14 10:16:24 +01:00
rapidio rapidio: devices: fix missing put_device in mport_cdev_open 2023-01-14 10:15:23 +01:00
ras
regulator regulator: da9211: Use irq handler when ready 2023-01-18 11:44:58 +01:00
remoteproc remoteproc: core: Do pm_relax when in RPROC_OFFLINE state 2023-01-14 10:16:36 +01:00
reset reset: imx7: Fix the iMX8MP PCIe PHY PERST support 2022-10-05 10:38:40 +02:00
rpmsg rpmsg: qcom: glink: replace strncpy() with strscpy_pad() 2022-10-15 07:55:54 +02:00
rtc rtc: ds1347: fix value written to century register 2023-01-14 10:16:34 +01:00
s390 s390/lcs: Fix return type of lcs_start_xmit() 2023-01-14 10:16:17 +01:00
sbus
scsi scsi: snic: Fix possible UAF in snic_tgt_create() 2023-01-14 10:15:52 +01:00
sfi
sh
siox siox: fix possible memory leak in siox_device_add() 2022-11-25 17:45:44 +01:00
slimbus slimbus: stream: correct presence rate frequencies 2022-11-25 17:45:50 +01:00
soc ARM: ux500: do not directly dereference __iomem 2023-01-14 10:16:30 +01:00
soundwire ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire 2023-01-14 10:16:28 +01:00
spi spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode 2023-01-14 10:15:41 +01:00
spmi spmi: pmic-arb: correct duplicate APID to PPID mapping logic 2022-10-26 13:25:39 +02:00
ssb
staging staging: media: tegra-video: fix device_node use after free 2023-01-14 10:16:41 +01:00
target scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() 2022-11-25 17:45:55 +01:00
tc
tee tee: optee: fix possible memory leak in optee_register_device() 2022-12-02 17:39:59 +01:00
thermal thermal/drivers/imx8mm_thermal: Validate temperature range 2023-01-14 10:16:01 +01:00
thunderbolt thunderbolt: Explicitly enable lane adapter hotplug events at startup 2022-10-26 13:25:16 +02:00
tty hvc/xen: lock console list traversal 2023-01-18 11:44:59 +01:00
uio uio: uio_dmem_genirq: Fix deadlock between irq config and handling 2023-01-14 10:15:55 +01:00
usb usb: ulpi: defer ulpi_register on ulpi_read_id timeout 2023-01-18 11:44:57 +01:00
vdpa vdpasim: allow to enable a vq repeatedly 2022-06-09 10:21:29 +02:00
vfio vfio: platform: Do not pass return buffer to ACPI _RST method 2023-01-14 10:15:54 +01:00
vhost vhost: fix range used in translate_desc() 2023-01-14 10:16:46 +01:00
video fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB 2023-01-14 10:16:49 +01:00
virt vboxguest: Do not use devm for irq 2022-08-25 11:38:14 +02:00
virtio virtio_mmio: Restore guest page size on resume 2022-07-21 21:20:13 +02:00
visorbus
vlynq
vme vme: Fix error not catched in fake_init() 2023-01-14 10:16:00 +01:00
w1 w1: w1_therm: fixes w1_seq for ds28ea00 sensors 2022-04-13 21:01:01 +02:00
watchdog watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() 2022-08-21 15:16:10 +02:00
xen xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() 2023-01-14 10:15:21 +01:00
zorro
Kconfig
Makefile