iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/char
History
Jann Horn b13d14339b ppdev: fix double-free of pp->pdev->name 
free_pardevice() is called by parport_unregister_device() and already frees
pp->pdev->name, don't try to do it again.

This bug causes kernel crashes.

I found and verified this with KASAN and some added pr_emerg()s:

[   60.316568] pp_release: pp->pdev->name == ffff88039cb264c0
[   60.316692] free_pardevice: freeing par_dev->name at ffff88039cb264c0
[   60.316706] pp_release: kfree(ffff88039cb264c0)
[   60.316714] ==========================================================
[   60.316722] BUG: Double free or freeing an invalid pointer
[   60.316731] Unexpected shadow byte: 0xFB
[   60.316801] Object at ffff88039cb264c0, in cache kmalloc-32 size: 32
[   60.316813] Allocated:
[   60.316824] PID = 1695
[   60.316869] Freed:
[   60.316880] PID = 1695
[   60.316935] ==========================================================

Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-10 15:24:02 +01:00
..
agp
agp/intel: Flush chipset writes after updating a single PTE
2016-08-18 22:36:23 +01:00
hw_random
hwrng: core - Don't use a stack buffer in add_early_randomness()
2016-10-19 11:20:21 +08:00
ipmi
ipmi: fix crash on reading version from proc after unregisted bmc
2016-10-03 09:09:47 -05:00
mwave
char/mwave: remove custom BOOLEAN type
2016-08-31 14:22:49 +02:00
pcmcia
TTY and Serial driver update for 4.7-rc1
2016-05-20 20:57:27 -07:00
tpm
Revert "tpm/tpm_crb: implement tpm crb idle state"
2016-09-27 12:02:13 +03:00
xilinx_hwicap
char:xilinx_hwicap:buffer_icap - change 1/0 to true/false for bool type variable in function buffer_icap_set_configuration().
2015-06-12 16:58:33 -07:00
xillybus
char: xillybus: Fix spelling mistake and comment
2016-08-31 14:47:54 +02:00
apm-emulation.c
apm-emulation: add hibernation APM events to support suspend2disk
2014-01-07 13:50:28 +01:00
applicom.c
applicom: dereferencing NULL on error path
2014-05-27 17:43:12 -07:00
applicom.h
…
bfin-otp.c
miscdevice: Use module_misc_device() macro
2016-08-31 14:12:35 +02:00
bsr.c
bsr: avoid format string leaking into device name
2014-07-09 16:59:15 -07:00
ds1302.c
…
ds1620.c
…
dsp56k.c
dsp56k: prevent a harmless underflow
2016-07-14 16:21:53 +09:00
dtlk.c
…
efirtc.c
drivers/char: make efirtc.c driver explicitly non-modular
2015-09-20 19:32:35 -07:00
generic_nvram.c
don't open-code generic_file_llseek_size()
2015-12-09 13:00:45 -05:00
hangcheck-timer.c
hangcheck-timer: cleanup casting in hangcheck_init()
2014-11-07 11:24:01 -08:00
hpet.c
hpet: Drop stale URLs
2016-02-17 09:39:56 +01:00
Kconfig
RTC for 4.8
2016-08-05 09:48:22 -04:00
lp.c
char: Int overflow in lp_do_ioctl().
2013-12-18 16:39:54 -08:00
Makefile
RTC for 4.8
2016-08-05 09:48:22 -04:00
mbcs.c
don't open-code generic_file_llseek_size()
2015-12-09 13:00:45 -05:00
mbcs.h
…
mem.c
drivers: char: mem: Check {read,write}_kmem() addresses
2016-08-31 15:21:18 +02:00
misc.c
char: make misc_deregister a void function
2015-08-05 10:35:49 -07:00
mmtimer.c
…
mspec.c
tree wide: use kvfree() than conditional kfree()/vfree()
2016-01-22 17:02:18 -08:00
nsc_gpio.c
…
nvram.c
char/nvram: set array of const as const
2016-02-08 14:57:30 -08:00
nwbutton.c
char: nwbutton: avoid unused variable warning
2016-02-09 17:39:56 -08:00
nwbutton.h
…
nwflash.c
new helpers: no_seek_end_llseek{,_size}()
2015-12-23 10:41:31 -05:00
pc8736x_gpio.c
…
powernv-op-panel.c
powerpc/powernv: Add driver for operator panel on FSP machines
2016-06-29 17:33:46 +10:00
ppdev.c
ppdev: fix double-free of pp->pdev->name
2016-11-10 15:24:02 +01:00
ps3flash.c
wrappers for ->i_mutex access
2016-01-22 18:04:28 -05:00
random.c
This adds a new gcc plugin named "latent_entropy". It is designed to
2016-10-15 10:03:15 -07:00
raw.c
drivers: char: raw: Removed unnecessary braces
2016-02-08 14:57:30 -08:00
rtc.c
various char drivers: remove deprecated IRQF_DISABLED
2013-10-16 12:36:10 -07:00
scx200_gpio.c
…
snsc_event.c
various char drivers: remove deprecated IRQF_DISABLED
2013-10-16 12:36:10 -07:00
snsc.c
snsc: check return value of class_create
2016-08-31 14:47:54 +02:00
snsc.h
…
sonypi.c
fs: Replace current_fs_time() with current_time()
2016-09-27 21:06:22 -04:00
tb0219.c
mips: separate extable.h, switch module.h to it
2016-10-05 18:36:18 -04:00
tile-srom.c
tile-srom: avoid krealloc(... __GFP_ZERO) pattern
2016-08-30 14:45:50 +02:00
tlclk.c
tlclk: remove deprecated IRQF_DISABLED
2013-10-16 12:36:10 -07:00
toshiba.c
toshiba laptop: replace ioremap_cache with ioremap
2015-08-05 17:26:00 -07:00
ttyprintk.c
ttyprintk: Neaten and simplify printing
2016-09-13 17:30:17 +02:00
uv_mmtimer.c
…
virtio_console.c
treewide: remove redundant #include <linux/kconfig.h>
2016-10-11 15:06:33 -07:00