iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
bb64c41da34438bb9e268378ce241f3e9faa8491
linux/drivers
History
Kefeng Wang bb64c41da3 media: wl128x: Fix some error handling in fm_v4l2_init_video_device() 
[ Upstream commit 69fbb3f473 ]

X-Originating-IP: [10.175.113.25]
X-CFilter-Loop: Reflected
The fm_v4l2_init_video_device() forget to unregister v4l2/video device
in the error path, it could lead to UAF issue, eg,

  BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
  BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
  BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x92/0x690 kernel/locking/mutex.c:1206
  Read of size 8 at addr ffff8881e84a7c70 by task v4l_id/3659

  CPU: 1 PID: 3659 Comm: v4l_id Not tainted 5.1.0 #8
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
  Call Trace:
   __dump_stack lib/dump_stack.c:77 [inline]
   dump_stack+0xa9/0x10e lib/dump_stack.c:113
   print_address_description+0x65/0x270 mm/kasan/report.c:187
   kasan_report+0x149/0x18d mm/kasan/report.c:317
   atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
   atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
   __mutex_unlock_slowpath+0x92/0x690 kernel/locking/mutex.c:1206
   fm_v4l2_fops_open+0xac/0x120 [fm_drv]
   v4l2_open+0x191/0x390 [videodev]
   chrdev_open+0x20d/0x570 fs/char_dev.c:417
   do_dentry_open+0x700/0xf30 fs/open.c:777
   do_last fs/namei.c:3416 [inline]
   path_openat+0x7c4/0x2a90 fs/namei.c:3532
   do_filp_open+0x1a5/0x2b0 fs/namei.c:3563
   do_sys_open+0x302/0x490 fs/open.c:1069
   do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7f8180c17c8e
  ...
  Allocated by task 3642:
   set_track mm/kasan/common.c:87 [inline]
   __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:497
   fm_drv_init+0x13/0x1000 [fm_drv]
   do_one_initcall+0xbc/0x47d init/main.c:901
   do_init_module+0x1b5/0x547 kernel/module.c:3456
   load_module+0x6405/0x8c10 kernel/module.c:3804
   __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
   do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

  Freed by task 3642:
   set_track mm/kasan/common.c:87 [inline]
   __kasan_slab_free+0x130/0x180 mm/kasan/common.c:459
   slab_free_hook mm/slub.c:1429 [inline]
   slab_free_freelist_hook mm/slub.c:1456 [inline]
   slab_free mm/slub.c:3003 [inline]
   kfree+0xe1/0x270 mm/slub.c:3958
   fm_drv_init+0x1e6/0x1000 [fm_drv]
   do_one_initcall+0xbc/0x47d init/main.c:901
   do_init_module+0x1b5/0x547 kernel/module.c:3456
   load_module+0x6405/0x8c10 kernel/module.c:3804
   __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
   do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

Add relevant unregister functions to fix it.

Cc: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-08-04 09:33:18 +02:00
..
accessibility
…
acpi
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
amba
…
android
binder: replace "%p" with "%pK"
2019-06-11 12:22:44 +02:00
ata
libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
2019-06-22 08:17:18 +02:00
atm
atm: he: fix sign-extension overflow on large shift
2019-02-27 10:06:59 +01:00
auxdisplay
…
base
PM / core: Propagate dev->power.wakeup_path when no callbacks
2019-05-31 06:48:26 -07:00
bcma
…
block
virtio-blk: limit number of hw queues by nr_cpu_ids
2019-05-10 17:52:09 +02:00
bluetooth
Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"
2018-11-27 16:09:40 +01:00
bus
bus: arm-cci: remove unnecessary unreachable()
2018-12-05 19:42:41 +01:00
cdrom
cdrom: Fix race condition in cdrom_sysctl_register
2019-04-05 22:29:12 +02:00
char
virtio_console: initialize vtermno value for ports
2019-05-31 06:48:29 -07:00
clk
clk: sunxi: fix uninitialized access
2019-07-10 09:55:44 +02:00
clocksource
clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
2019-03-23 13:19:46 +01:00
connector
…
cpufreq
cpufreq: pmac32: fix possible object reference leak
2019-05-31 06:48:27 -07:00
cpuidle
cpuidle: big.LITTLE: fix refcount leak
2019-02-12 19:44:55 +01:00
crypto
crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
2019-08-04 09:33:17 +02:00
dax
…
dca
…
devfreq
…
dio
…
dma
dmaengine: imx-sdma: fix use-after-free on probe error path
2019-08-04 09:33:14 +02:00
dma-buf
dma-buf: remove redundant initialization of sg_table
2018-06-06 16:44:33 +02:00
edac
EDAC, skx_edac: Fix logical channel intermediate decoding
2018-11-13 11:16:56 -08:00
eisa
…
extcon
extcon: arizona: Disable mic detect if running when driver is removed
2019-05-31 06:48:26 -07:00
firewire
firewire-ohci: work around oversized DMA reads on JMicron controllers
2018-05-30 07:50:18 +02:00
firmware
efi/libstub: Unify command line param parsing
2019-06-11 12:22:45 +02:00
fmc
…
fpga
…
gpio
gpio: fix gpio-adp5588 build errors
2019-06-22 08:17:23 +02:00
gpu
drm/imx: only send event on crtc disable if kept disabled
2019-07-10 09:55:46 +02:00
hid
HID: core: move Usage Page concatenation to Main item
2019-05-31 06:48:29 -07:00
hsi
…
hv
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
2018-12-29 13:40:15 +01:00
hwmon
hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
2019-07-10 09:55:32 +02:00
hwspinlock
…
hwtracing
intel_th: msu: Fix single mode with IOMMU
2019-05-25 18:26:46 +02:00
i2c
i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
2019-06-22 08:17:23 +02:00
ide
ide: pmac: add of_node_put()
2018-12-21 14:11:37 +01:00
idle
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
iio
iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
2019-05-31 06:48:27 -07:00
infiniband
IB/hfi1: Close PSM sdma_progress sleep window
2019-07-10 09:55:47 +02:00
input
Input: imx_keypad - make sure keyboard can always wake up system
2019-07-21 09:05:54 +02:00
iommu
iommu/vt-d: Set intel_iommu_gfx_mapped correctly
2019-06-22 08:17:14 +02:00
ipack
…
irqchip
Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
2019-06-11 12:22:48 +02:00
isdn
mISDN: make sure device name is NUL terminated
2019-06-22 08:17:22 +02:00
leds
leds: pca9532: fix a potential NULL pointer dereference
2019-05-04 08:49:10 +02:00
lguest
…
lightnvm
…
macintosh
macintosh/rack-meter: Convert cputime64_t use to u64
2018-10-20 09:51:32 +02:00
mailbox
mailbox: xgene-slimpro: Fix potential NULL pointer dereference
2018-09-09 20:01:19 +02:00
mcb
…
md
dm verity: use message limit for data block corruption message
2019-07-21 09:06:07 +02:00
media
media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
2019-08-04 09:33:18 +02:00
memory
memory: tegra: Fix integer overflow on tick value calculation
2019-05-25 18:26:49 +02:00
memstick
memstick: Prevent memstick host from getting runtime suspended during card detection
2019-02-12 19:44:55 +01:00
message
…
mfd
mfd: omap-usb-tll: Fix register offsets
2019-07-10 09:55:44 +02:00
misc
VMCI: Fix integer overflow in VMCI handle arrays
2019-07-21 09:06:03 +02:00
mmc
mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
2019-05-31 06:48:25 -07:00
mtd
mtd: rawnand: gpmi: fix MX28 bus master lockup problem
2019-02-15 08:07:37 +01:00
net
net: phy: Check against net_device being NULL
2019-08-04 09:33:17 +02:00
nfc
spi: ST ST95HF NFC: declare missing of table
2019-05-16 19:43:43 +02:00
ntb
ntb_transport: Fix bug with max_mw_size parameter
2018-05-30 07:50:22 +02:00
nubus
…
nvdimm
libnvdimm/namespace: Fix label tracking error
2019-05-31 06:48:11 -07:00
nvme
nvme: Fix u32 overflow in the number of namespace list calculation
2019-07-10 09:55:32 +02:00
nvmem
nvmem: core: fix read buffer in place
2019-06-22 08:17:15 +02:00
of
of: add helper to lookup compatible child node
2018-12-01 09:44:21 +01:00
oprofile
…
parisc
parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
2019-06-11 12:22:47 +02:00
parport
parport: Fix mem leak in parport_register_dev_model
2019-07-10 09:55:29 +02:00
pci
PCI: xilinx: Check for __get_free_pages() failure
2019-06-22 08:17:17 +02:00
pcmcia
pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
2018-11-13 11:16:46 -08:00
perf
…
phy
phy: tegra: remove redundant self assignment of 'map'
2019-02-27 10:07:03 +01:00
pinctrl
pinctrl: pistachio: fix leaked of_node references
2019-05-31 06:48:18 -07:00
platform
platform/x86: intel_pmc_ipc: adding error handling
2019-06-22 08:17:16 +02:00
pnp
…
power
power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
2019-05-25 18:26:56 +02:00
powercap
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
pps
…
ps3
…
ptp
ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
2019-02-12 19:44:52 +01:00
pwm
pwm: Fix deadlock warning when removing PWM device
2019-06-22 08:17:17 +02:00
rapidio
rapidio: fix a NULL pointer dereference when create_workqueue() fails
2019-06-22 08:17:11 +02:00
ras
…
regulator
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
2019-04-05 22:29:14 +02:00
remoteproc
…
reset
reset: make device_reset_optional() really optional
2018-12-08 13:05:08 +01:00
rpmsg
rpmsg: smd: fix memory leak on channel create
2018-11-13 11:17:03 -08:00
rtc
rtc: pcf8523: don't return invalid date when battery is low
2019-06-22 08:17:21 +02:00
s390
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
2019-07-21 09:06:08 +02:00
sbus
drivers/sbus/char: add of_node_put()
2018-12-21 14:11:36 +01:00
scsi
scsi: hpsa: correct ioaccel2 chaining
2019-07-10 09:55:43 +02:00
sfi
…
sh
…
sn
…
soc
soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
2019-06-22 08:17:15 +02:00
spi
spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
2019-07-10 09:55:43 +02:00
spmi
…
ssb
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
2019-05-31 06:48:12 -07:00
staging
media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
2019-08-04 09:33:17 +02:00
target
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
2019-03-23 13:19:47 +01:00
tc
TC: Set DMA masks for devices
2018-11-13 11:17:02 -08:00
thermal
drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
2019-06-22 08:17:13 +02:00
thunderbolt
…
tty
Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
2019-07-21 09:06:00 +02:00
uio
uio: Fix an Oops on load
2018-11-27 16:09:41 +01:00
usb
usb: renesas_usbhs: add a workaround for a race condition of workqueue
2019-07-21 09:06:01 +02:00
uwb
uwb: hwa-rc: fix memory leak at probe
2018-10-03 17:01:42 -07:00
vfio
vfio/pci: use correct format characters
2019-05-08 07:19:10 +02:00
vhost
vhost: reject zero size iova range
2019-04-27 09:34:40 +02:00
video
video: imsttfb: fix potential NULL pointer dereferences
2019-06-22 08:17:17 +02:00
virt
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
2019-05-16 19:43:47 +02:00
virtio
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
2019-04-17 08:36:47 +02:00
vlynq
…
vme
…
w1
w1: fix the resume command API
2019-05-31 06:48:15 -07:00
watchdog
watchdog: fix compile time error of pretimeout governors
2019-06-22 08:17:14 +02:00
xen
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
2019-06-11 12:22:49 +02:00
zorro
zorro: Set up z->dev.dma_mask for the DMA API
2018-05-30 07:50:44 +02:00
Kconfig
…
Makefile
…