TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
v6.6.49
twx-linux/drivers
History
Ben Hutchings 8a3995a3ff scsi: aacraid: Fix double-free on probe failure 
[ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ]

aac_probe_one() calls hardware-specific init functions through the
aac_driver_ident::init pointer, all of which eventually call down to
aac_init_adapter().

If aac_init_adapter() fails after allocating memory for aac_dev::queues,
it frees the memory but does not clear that member.

After the hardware-specific init function returns an error,
aac_probe_one() goes down an error path that frees the memory pointed to
by aac_dev::queues, resulting.in a double-free.

Reported-by: Michael Gordon <m.gordon.zelenoborsky@gmail.com>
Link: https://bugs.debian.org/1075855
Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support")
Signed-off-by: Ben Hutchings <benh@debian.org>
Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-04 13:28:31 +02:00
..
accel accel/habanalabs: fix debugfs files permissions 2024-08-29 17:33:35 +02:00
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:11:18 +02:00
acpi ACPI: EC: Evaluate _REG outside the EC scope more carefully 2024-08-29 17:33:13 +02:00
amba
android binder: fix hang of unregistered readers 2024-08-03 08:54:21 +02:00
ata Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error" 2024-08-19 06:04:31 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:33:18 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:54:39 +02:00
base driver core: Fix uevent_show() vs driver detach race 2024-08-14 13:58:56 +02:00
bcma
block rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings 2024-08-03 08:54:32 +02:00
bluetooth Bluetooth: btnxpuart: Fix random crash seen while removing driver 2024-09-04 13:28:25 +02:00
bus
cache
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:49:10 +02:00
cdx
char char: xillybus: Check USB endpoints when probing device 2024-08-29 17:33:11 +02:00
clk clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider 2024-08-29 17:33:29 +02:00
clocksource clocksource/drivers/arm_global_timer: Guard against division by zero 2024-08-29 17:33:35 +02:00
comedi
connector
counter counter: ti-eqep: enable clock at probe 2024-07-05 09:33:56 +02:00
cpufreq cpufreq: qcom-nvmem: fix memory leaks in probe error paths 2024-08-11 12:47:14 +02:00
cpuidle
crypto crypto: qat - extend scope of lock in adf_cfg_add_key_value_param() 2024-08-03 08:54:01 +02:00
cxl cxl/region: check interleave capability 2024-07-05 09:34:07 +02:00
dax
dca
devfreq
dio
dma dmaengine: dw: Add memory bus width verification 2024-09-04 13:28:25 +02:00
dma-buf dma-buf: handle testing kthreads creation failure 2024-06-21 14:38:40 +02:00
edac EDAC/skx_common: Allow decoding of SGX addresses 2024-08-29 17:33:41 +02:00
eisa
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:12:27 +02:00
firewire firewire: ohci: fulfill timestamp for some local asynchronous transaction 2024-05-17 12:02:30 +02:00
firmware firmware: qcom: scm: Mark get_wq_ctx() as atomic call 2024-09-04 13:28:28 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:12:23 +02:00
fsi
gnss
gpio gpio: sysfs: extend the critical section for unregistering sysfs devices 2024-08-29 17:33:34 +02:00
gpu drm/amd/display: avoid using null object of framebuffer 2024-09-04 13:28:27 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
hid HID: wacom: Defer calculation of resolution until resolution_code is known 2024-08-29 17:33:53 +02:00
hsi
hte
hv Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted 2024-05-17 12:02:17 +02:00
hwmon hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() 2024-08-29 17:33:57 +02:00
hwspinlock
hwtracing coresight: Fix ref leak when of_coresight_parse_endpoint() fails 2024-08-03 08:53:57 +02:00
i2c i2c: stm32f7: Add atomic_xfer method to driver 2024-08-29 17:33:42 +02:00
i3c i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer 2024-08-29 17:33:25 +02:00
idle
iio iio: frequency: adrf6780: rm clk provider include 2024-08-03 08:53:56 +02:00
infiniband IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock 2024-08-29 17:33:29 +02:00
input Input: MT - limit max slots 2024-08-29 17:33:59 +02:00
interconnect interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID 2024-08-03 08:53:58 +02:00
iommu iommu: Do not return 0 from map_pages if it doesn't do anything 2024-09-04 13:28:26 +02:00
ipack
irqchip irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc 2024-08-29 17:33:40 +02:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-08-19 06:04:28 +02:00
leds leds: triggers: Flush pending brightness before activating trigger 2024-08-11 12:47:14 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:54:02 +02:00
mailbox
mcb
md dm suspend: return -ERESTARTSYS instead of -EINTR 2024-08-29 17:33:42 +02:00
media media: drivers/media/dvb-core: copy user arrays safely 2024-08-29 17:33:34 +02:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-08-29 17:33:36 +02:00
memstick
message
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-03 08:53:54 +02:00
misc Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD" 2024-08-29 17:33:10 +02:00
mmc mmc: dw_mmc: allow biu and ciu clocks to defer 2024-08-29 17:33:54 +02:00
most
mtd ubi: eba: properly rollback inside self_check_eba 2024-08-03 08:54:23 +02:00
mux
net gtp: fix a potential NULL pointer dereference 2024-09-04 13:28:27 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:28:28 +02:00
ntb
nubus
nvdimm
nvme nvme: fix namespace removal list 2024-08-29 17:33:42 +02:00
nvmem nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option 2024-08-03 08:54:01 +02:00
of of/irq: Disable "interrupt-map" parsing for PASEMI Nemo 2024-07-25 09:50:57 +02:00
opp OPP: ti: Fix ti_opp_supply_probe wrong return values 2024-08-03 08:53:27 +02:00
parisc Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
parport dev/parport: fix the array out-of-bounds risk 2024-08-03 08:54:22 +02:00
pci PCI: Add pci_get_base_class() helper 2024-08-11 12:47:15 +02:00
pcmcia
peci
perf perf: riscv: Fix selecting counters in legacy mode 2024-08-11 12:47:23 +02:00
phy phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume 2024-09-04 13:28:25 +02:00
pinctrl pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register 2024-09-04 13:28:23 +02:00
platform platform/x86/intel/ifs: Call release_firmware() when handling errors. 2024-08-29 17:33:57 +02:00
pmdomain pmdomain: imx: wait SSAR when i.MX93 power domain on 2024-08-29 17:33:54 +02:00
pnp
power soc: qcom: pmic_glink: Fix race during initialization 2024-09-04 13:28:28 +02:00
powercap
pps
ps3
ptp ptp: fix integer overflow in max_vclocks_store 2024-06-27 13:49:07 +02:00
pwm pwm: atmel-tcb: Fix race condition and convert to guards 2024-08-03 08:53:23 +02:00
rapidio
ras
regulator regulator: bd71815: fix ramp values 2024-06-27 13:49:09 +02:00
remoteproc remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init 2024-08-03 08:54:31 +02:00
reset
rpmsg
rtc rtc: nct3018y: fix possible NULL dereference 2024-08-29 17:33:39 +02:00
s390 Revert "s390/dasd: Establish DMA alignment" 2024-08-29 17:33:59 +02:00
sbus
scsi scsi: aacraid: Fix double-free on probe failure 2024-09-04 13:28:31 +02:00
sh
siox
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 12:02:33 +02:00
soc soc: qcom: pmic_glink: Fix race during initialization 2024-09-04 13:28:28 +02:00
soundwire soundwire: stream: fix programming slave ports for non-continous port maps 2024-09-04 13:28:24 +02:00
spi spi: spi-fsl-lpspi: Fix scldiv calculation 2024-08-14 13:58:52 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:38:40 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:33:22 +02:00
staging staging: ks7010: disable bh on tx_dev_lock 2024-08-29 17:33:26 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 12:02:15 +02:00
tc
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:50:53 +02:00
thermal thermal: of: Fix OF node leak in of_thermal_zone_find() error paths 2024-09-04 13:28:22 +02:00
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-08-29 17:33:12 +02:00
tty tty: atmel_serial: use the correct RTS flag. 2024-08-29 17:33:10 +02:00
ufs scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic 2024-08-14 13:58:55 +02:00
uio uio_hv_generic: Don't free decrypted memory 2024-05-17 12:02:17 +02:00
usb usb: cdnsp: fix for Link TRB with TC 2024-09-04 13:28:30 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:33:50 +02:00
vfio vfio/pci: Init the count variable in collecting hot-reset devices 2024-07-18 13:21:10 +02:00
vhost vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler 2024-08-14 13:58:55 +02:00
video fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes 2024-08-11 12:47:16 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:12:09 +02:00
virtio virtio: delete vq in vp_find_vqs_msix() when request_irq() fails 2024-06-12 11:12:49 +02:00
vlynq
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: rzg2l_wdt: Check return status of pm_runtime_put() 2024-08-03 08:54:35 +02:00
xen Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
zorro
Kconfig
Makefile