Catalin Marinas 1a3389ffc5 drivers: dma-mapping: Do not leave an invalid area->pages pointer in dma_common_contiguous_remap() ...

The dma_common_pages_remap() function allocates a vm_struct object and
initialises the pages pointer to value passed as argument. However, when
this function is called dma_common_contiguous_remap(), the pages array
is only temporarily allocated, being freed shortly after
dma_common_contiguous_remap() returns. Architecture code checking the
validity of an area->pages pointer would incorrectly dereference already
freed pointers. This has been exposed by the arm64 commit 44176bb38fa4
("arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU").

Fixes: 513510ddba96 ("common: dma-mapping: introduce common remapping functions")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reported-by: Andrzej Hajda <a.hajda@samsung.com>
Acked-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-06-03 18:51:12 +09:00

..

power

More power management updates for v4.12-rc1

2017-05-10 09:12:30 -07:00

regmap

Merge remote-tracking branches 'regmap/topic/doc' and 'regmap/topic/rbtree' into regmap-next

2017-02-03 12:34:59 +01:00

test

driver core: test_async: fix up typo found by 0-day

2016-11-29 22:06:42 +01:00

attribute_container.c

attribute_container: Fix typo

2016-08-31 15:13:56 +02:00

base.h

Revert "driver core: Add deferred_probe attribute to devices in sysfs"

2017-01-14 14:09:03 +01:00

bus.c

kobject: support passing in variables for synthetic uevents

2017-05-25 18:30:51 +02:00

cacheinfo.c

Merge branch 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2016-12-22 09:25:45 -08:00

class.c

driver core: class: add class_groups support

2016-11-29 21:12:12 +01:00

component.c

Merge 4.5-rc4 into driver-core-next

2016-02-14 14:29:55 -08:00

container.c

…

core.c

kobject: support passing in variables for synthetic uevents

2017-05-25 18:30:51 +02:00

cpu.c

CPU / PM: expose pm_qos_resume_latency for CPUs

2017-01-30 11:05:29 +01:00

dd.c

of/acpi: Configure dma operations at probe time for platform/amba/pci bus devices

2017-04-20 16:31:06 +02:00

devcoredump.c

driver core: devcoredump: convert to use class_groups

2016-11-29 21:12:12 +01:00

devres.c

devres: add devm_alloc_percpu()

2016-11-15 22:34:25 -05:00

devtmpfs.c

statx: Add a system call to make enhanced file info available

2017-03-02 20:51:15 -05:00

dma-coherent.c

drivers: dma-coherent: Move spinlock in dma_alloc_from_coherent()

2016-09-28 17:53:16 +02:00

dma-contiguous.c

cma: Store a name in the cma structure

2017-04-18 20:41:12 +02:00

dma-mapping.c

drivers: dma-mapping: Do not leave an invalid area->pages pointer in dma_common_contiguous_remap()

2017-06-03 18:51:12 +09:00

driver.c

driver core: add missing blank line after declaration

2015-03-25 14:36:30 +01:00

firmware_class.c

firmware: fix NULL pointer dereference in __fw_load_abort()

2017-01-27 09:19:48 +01:00

firmware.c

…

hypervisor.c

…

init.c

drivers: of/base: move of_init to driver_init

2015-05-26 19:55:56 -07:00

isa.c

isa: Call isa_bus_init before dependent ISA bus drivers register

2016-06-17 20:47:11 -07:00

Kconfig

Driver core patches for 4.10-rc1

2016-12-13 11:42:18 -08:00

Makefile

driver-core: add test module for asynchronous probing

2016-11-10 17:28:16 +01:00

map.c

drivers: base: map: Use kmalloc_array instead of kmalloc

2015-03-25 14:35:08 +01:00

memory.c

memory-hotplug: use dev_online for memhp_auto_online

2017-02-24 17:46:56 -08:00

module.c

base: make module_create_drivers_dir race-free

2016-06-15 19:21:31 -07:00

node.c

treewide: replace obsolete _refok by __ref

2016-08-02 17:31:41 -04:00

pinctrl.c

driver: base: pinctrl: return error from pinctrl_bind_pins()

2016-09-13 23:02:59 +02:00

platform-msi.c

platform-msi: Make platform_msi_create_device_domain() ACPI aware

2017-04-07 10:52:19 +01:00

platform.c

driver core: platform: fix race condition with driver_override

2017-05-25 15:30:12 +02:00

property.c

device property: Read strings using string array reading functions

2017-03-29 22:59:40 +02:00

soc.c

base: soc: Allow early registration of a single SoC device

2017-03-29 21:43:26 +02:00

syscore.c

genirq: Simplify wakeup mechanism

2014-09-01 13:48:59 +02:00

topology.c

drivers base/topology: Convert to hotplug state machine

2016-11-09 23:45:29 +01:00

transport_class.c

…