TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
69cd304cfa5cfb0f130488af579c143382432766
twx-linux/drivers
T
History
Steve Cohen 6a9428427d drm: hold gem reference until object is no longer accessed 
commit 8490d6a7e0 upstream.

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-05 09:59:44 +02:00
..
accessibility
…
acpi
ACPI: video: Use native backlight on Acer TravelMate 5735Z
2020-07-22 09:33:00 +02:00
amba
…
android
binder: Don't use mmput() from shrinker function.
2020-07-29 10:18:41 +02:00
ata
ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
2020-06-30 15:37:03 -04:00
atm
…
auxdisplay
…
base
PM: wakeup: Show statistics for deleted wakeup sources again
2020-07-31 18:39:32 +02:00
bcma
…
block
Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
2020-07-22 09:33:12 +02:00
bluetooth
Bluetooth: hci_bcm: fix freeing not-requested IRQ
2020-06-22 09:31:18 +02:00
bus
bus: ti-sysc: Do not disable on suspend for no-idle
2020-07-22 09:33:01 +02:00
cdrom
…
char
/dev/mem: Add missing memory barriers for devmem_inode
2020-07-29 10:18:43 +02:00
clk
clk: qcom: gcc: Add missing UFS clocks for SM8150
2020-07-22 09:33:07 +02:00
clocksource
arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040
2020-07-22 09:32:51 +02:00
connector
…
counter
counter: 104-quad-8: Add lock guards - generic interface
2020-05-02 08:48:44 +02:00
cpufreq
cpufreq: Fix up cpufreq_boost_set_sw()
2020-06-17 16:40:33 +02:00
cpuidle
cpuidle: Fix three reference count leaks
2020-06-22 09:31:10 +02:00
crypto
crypto: ccp - Release all allocated memory if sha type is invalid
2020-08-05 09:59:40 +02:00
dax
device-dax: don't leak kernel memory to user space after unloading kmem
2020-05-27 17:46:48 +02:00
dca
…
devfreq
PM / devfreq: Add missing locking while setting suspend_freq
2020-05-10 10:31:34 +02:00
dio
…
dma
dmaengine: ioat setting ioat timeout as module parameter
2020-07-29 10:18:37 +02:00
dma-buf
dmabuf: use spinlock to access dmabuf->name
2020-07-29 10:18:29 +02:00
edac
EDAC/amd64: Read back the scrub rate PCI register on F15h
2020-07-09 09:37:49 +02:00
eisa
…
extcon
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-24 17:50:36 +02:00
firewire
…
firmware
drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
2020-07-29 10:18:28 +02:00
fpga
fpga: dfl: fix bug in port reset handshake
2020-07-29 10:18:31 +02:00
fsi
…
gnss
gnss: sirf: fix error return code in sirf_probe()
2020-06-22 09:31:20 +02:00
gpio
gpio: arizona: put pm_runtime in case of failure
2020-07-29 10:18:26 +02:00
gpu
drm: hold gem reference until object is no longer accessed
2020-08-05 09:59:44 +02:00
greybus
…
hid
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
2020-07-29 10:18:36 +02:00
hsi
…
hv
Drivers: hv: vmbus: Always handle the VMBus messages on CPU0
2020-06-22 09:31:00 +02:00
hwmon
hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
2020-07-29 10:18:39 +02:00
hwspinlock
…
hwtracing
intel_th: Fix a NULL dereference when hub driver is not loaded
2020-07-22 09:33:15 +02:00
i2c
i2c: i2c-qcom-geni: Fix DMA transfer race
2020-07-29 10:18:35 +02:00
i3c
…
ide
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-24 08:36:53 +01:00
idle
…
iio
iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()'
2020-07-22 09:33:02 +02:00
infiniband
IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
2020-08-05 09:59:42 +02:00
input
Input: elan_i2c - only increment wakeup count on touch
2020-07-29 10:18:38 +02:00
interconnect
…
iommu
irqdomain/treewide: Keep firmware node unconditionally allocated
2020-07-29 10:18:28 +02:00
ipack
ipack: tpci200: fix error return code in tpci200_register()
2020-05-27 17:46:47 +02:00
irqchip
irqchip/gic: Atomically update affinity
2020-07-09 09:37:56 +02:00
isdn
…
leds
leds: core: Fix warning message when init_data
2020-04-23 10:36:37 +02:00
lightnvm
…
macintosh
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-22 09:31:22 +02:00
mailbox
mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe()
2020-06-24 17:50:36 +02:00
mcb
…
md
dm integrity: fix integrity recalculation that is improperly skipped
2020-07-29 10:18:45 +02:00
media
media: rc: prevent memory leak in cx23888_ir_probe
2020-08-05 09:59:40 +02:00
memory
…
memstick
…
message
scsi: mptscsih: Fix read sense data size
2020-07-16 08:16:36 +02:00
mfd
mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt
2020-06-24 17:50:33 +02:00
misc
misc: atmel-ssc: lock with mutex instead of spinlock
2020-07-22 09:33:15 +02:00
mmc
mmc: sdhci-of-aspeed: Fix clock divider calculation
2020-07-29 10:18:44 +02:00
mtd
mtd: rawnand: oxnas: Release all devices in the _remove() path
2020-07-22 09:33:07 +02:00
mux
…
net
ath10k: enable transmit data ack RSSI for QCA9884
2020-08-05 09:59:41 +02:00
nfc
NFC: st21nfca: add missed kfree_skb() in an error path
2020-06-10 20:24:54 +02:00
ntb
NTB: perf: Fix race condition when run with ntb_test
2020-06-24 17:50:41 +02:00
nubus
…
nvdimm
libnvdimm: Out of bounds read in __nd_ioctl()
2020-04-23 10:36:42 +02:00
nvme
nvme-rdma: assign completion vector correctly
2020-07-16 08:16:36 +02:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-06-10 20:24:57 +02:00
of
of: of_mdio: Correct loop scanning logic
2020-07-22 09:32:55 +02:00
opp
…
oprofile
…
parisc
…
parport
…
pci
PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
2020-08-05 09:59:41 +02:00
pcmcia
…
perf
drivers/perf: Prevent forced unbinding of PMU drivers
2020-07-29 10:18:40 +02:00
phy
phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
2020-07-22 09:33:01 +02:00
pinctrl
pinctrl: amd: fix npins for uart0 in kerncz_groups
2020-07-29 10:18:26 +02:00
platform
platform/x86: asus-wmi: allow BAT1 battery name
2020-07-29 10:18:39 +02:00
pnp
…
power
power: supply: smb347-charger: IRQSTAT_D is volatile
2020-06-24 17:50:25 +02:00
powercap
…
pps
…
ps3
…
ptp
…
pwm
pwm: jz4740: Fix build failure
2020-07-16 08:16:48 +02:00
rapidio
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 17:46:48 +02:00
ras
…
regulator
regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
2020-06-30 15:36:54 -04:00
remoteproc
remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use
2020-06-24 17:50:13 +02:00
reset
…
rpmsg
…
rtc
rtc: rv3028: Add missed check for devm_regmap_init_i2c()
2020-06-24 17:50:36 +02:00
s390
s390/qeth: fix error handling for isolation mode cmds
2020-06-30 15:36:57 -04:00
sbus
…
scsi
scsi: dh: Add Fujitsu device to devinfo and dh lists
2020-07-29 10:18:27 +02:00
sfi
…
sh
…
siox
…
slimbus
slimbus: core: Fix mismatch in of_node_get/put
2020-07-22 09:33:08 +02:00
soc
soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
2020-07-29 10:18:25 +02:00
soundwire
soundwire: intel: fix memory leak with devm_kasprintf
2020-07-22 09:33:00 +02:00
spi
spi: mediatek: use correct SPI_CFG2_REG MACRO
2020-07-29 10:18:37 +02:00
spmi
…
ssb
…
staging
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
2020-07-29 10:18:42 +02:00
target
scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd()
2020-06-24 17:50:34 +02:00
tc
…
tee
…
thermal
thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power
2020-07-22 09:33:16 +02:00
thunderbolt
thunderbolt: Prevent crash if non-active NVMem file is read
2020-02-28 17:22:13 +01:00
tty
vt: Reject zero-sized screen buffer size.
2020-07-29 10:18:43 +02:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:33:13 +02:00
usb
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
2020-07-29 10:18:41 +02:00
vfio
vfio/mdev: Fix reference count leak in add_mdev_supported_type
2020-06-24 17:50:36 +02:00
vhost
vhost/scsi: fix up req type endian-ness
2020-08-05 09:59:42 +02:00
video
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
2020-07-29 10:18:43 +02:00
virt
virt: vbox: Fix guest capabilities mask check
2020-07-22 09:33:11 +02:00
virtio
virtio_balloon: fix up endian-ness for free cmd id
2020-08-05 09:59:43 +02:00
visorbus
…
vlynq
…
vme
…
w1
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-22 09:31:26 +02:00
watchdog
watchdog: da9062: No need to ping manually before setting timeout
2020-06-24 17:50:32 +02:00
xen
xen/pvcalls-back: test for errors when calling backend_connect()
2020-06-17 16:40:38 +02:00
zorro
…
Kconfig
…
Makefile
…