averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-14 21:43:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
c368f751da8edfe50c31179ff084e205bcf79ea0
linux-stable-mirror/drivers
T
History
Hyunwoo KimandGreg Kroah-Hartman d9ddfeb01f fbdev: smscufx: Fix several use-after-free bugs 
commit cc67482c9e upstream.

Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-03 23:57:49 +09:00
..
accessibility
…
acpi
ACPI: video: Force backlight native for more TongFang devices
2022-10-30 09:41:19 +01:00
amba
…
android
…
ata
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
2022-10-30 09:41:15 +01:00
atm
…
auxdisplay
…
base
arm64: topology: move store_cpu_topology() to shared code
2022-10-30 09:41:19 +01:00
bcma
…
block
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
2022-10-26 13:25:52 +02:00
bluetooth
…
bus
…
cdrom
…
char
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
2022-10-26 13:25:41 +02:00
clk
clk: bcm2835: Make peripheral PLLC critical
2022-10-26 13:25:54 +02:00
clocksource
…
connector
…
counter
…
cpufreq
cpufreq: qcom: fix memory leak in error path
2022-10-30 09:41:15 +01:00
cpuidle
…
crypto
crypto: cavium - prevent integer overflow loading firmware
2022-10-26 13:25:43 +02:00
dax
…
dca
…
devfreq
…
dio
…
dma
dmaengine: mxs: use platform_driver_register
2022-10-30 09:41:18 +01:00
dma-buf
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
2022-10-26 13:25:48 +02:00
edac
…
eisa
…
extcon
…
firewire
…
firmware
firmware: google: Test spinlock on panic path to avoid lockups
2022-10-26 13:25:37 +02:00
fpga
…
fsi
fsi: core: Check error number after calling ida_simple_get
2022-10-26 13:25:38 +02:00
gnss
…
gpio
…
gpu
drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
2022-10-30 09:41:18 +01:00
greybus
…
hid
HID: magicmouse: Do not set BTN_MOUSE on double report
2022-10-30 09:41:16 +01:00
hsi
…
hv
…
hwmon
hwmon/coretemp: Handle large core ID value
2022-10-30 09:41:15 +01:00
hwspinlock
…
hwtracing
…
i2c
i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter
2022-10-30 09:41:15 +01:00
i3c
…
ide
…
idle
…
iio
iio: temperature: ltc2983: allocate iio channels once
2022-11-03 23:57:49 +09:00
infiniband
IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
2022-10-26 13:25:36 +02:00
input
…
interconnect
…
iommu
iommu/vt-d: Clean up si_domain in the init_dmars() error path
2022-10-30 09:41:18 +01:00
ipack
…
irqchip
…
isdn
…
leds
…
lightnvm
…
macintosh
…
mailbox
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
2022-10-26 13:25:40 +02:00
mcb
…
md
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
2022-10-26 13:25:53 +02:00
media
media: venus: dec: Handle the case where find_format fails
2022-10-30 09:41:15 +01:00
memory
…
memstick
…
message
…
mfd
mfd: sm501: Add check for platform_driver_register()
2022-10-26 13:25:38 +02:00
misc
…
mmc
mmc: core: Add SD card quirk for broken discard
2022-10-30 09:41:19 +01:00
most
…
mtd
mtd: rawnand: marvell: Use correct logic for nand-keep-config
2022-11-03 23:57:49 +09:00
mux
…
net
can: kvaser_usb: Fix possible completions during init_completion
2022-11-03 23:57:48 +09:00
nfc
…
ntb
…
nubus
…
nvdimm
…
nvme
nvme-hwmon: kmalloc the NVME SMART log buffer
2022-10-30 09:41:17 +01:00
nvmem
…
of
…
opp
…
oprofile
…
parisc
…
parport
…
pci
…
pcmcia
…
perf
…
phy
phy: qualcomm: call clk_disable_unprepare in the error handling
2022-10-26 13:25:37 +02:00
pinctrl
…
platform
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
2022-10-26 13:25:49 +02:00
pnp
…
power
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
2022-10-26 13:25:52 +02:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:25:44 +02:00
pps
…
ps3
…
ptp
…
pwm
…
rapidio
…
ras
…
regulator
regulator: core: Prevent integer underflow
2022-10-26 13:25:46 +02:00
remoteproc
…
reset
…
rpmsg
…
rtc
…
s390
…
sbus
…
scsi
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
2022-10-26 13:25:52 +02:00
sfi
…
sh
…
siox
…
slimbus
…
soc
…
soundwire
soundwire: intel: fix error handling on dai registration issues
2022-10-26 13:25:53 +02:00
spi
…
spmi
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 13:25:39 +02:00
ssb
…
staging
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
2022-10-26 13:25:54 +02:00
target
…
tc
…
tee
…
thermal
thermal: intel_powerclamp: Use first online CPU as control_cpu
2022-10-26 13:25:56 +02:00
thunderbolt
…
tty
serial: 8250: Fix restoring termios speed after suspend
2022-10-26 13:25:37 +02:00
uio
…
usb
xhci: Remove device endpoints from bandwidth list when freeing the device
2022-11-03 23:57:49 +09:00
vdpa
…
vfio
…
vhost
…
video
fbdev: smscufx: Fix several use-after-free bugs
2022-11-03 23:57:49 +09:00
virt
…
virtio
…
visorbus
…
vlynq
…
vme
…
w1
…
watchdog
…
xen
xen/gntdev: Accommodate VMA splitting
2022-10-30 09:41:18 +01:00
zorro
…
Kconfig
…
Makefile
…