iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Mathias Krause 6066977961 drm/vmwgfx: Fix stale file descriptors on failed usercopy 
commit a0f90c8815706981c483a652a6aefca51a5e191c upstream.

A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.

Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.

Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-29 10:58:25 +01:00
..
accessibility
…
acpi
ACPI: CPPC: Check present CPUs for determining _CPC is valid
2022-01-27 11:04:51 +01:00
amba
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-06 14:13:31 +01:00
android
binder: avoid potential data leakage when copying txn
2022-01-27 11:04:09 +01:00
ata
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
2021-12-22 09:32:49 +01:00
atm
…
auxdisplay
auxdisplay: charlcd: checking for pointer reference before dereferencing
2022-01-11 15:35:17 +01:00
base
device property: Fix fwnode_graph_devcon_match() fwnode leak
2022-01-27 11:05:10 +01:00
bcma
…
block
floppy: Add max size check for user space request
2022-01-27 11:04:34 +01:00
bluetooth
Bluetooth: btusb: Return error code when getting patch status failed
2022-01-27 11:05:22 +01:00
bus
bus: mhi: core: Fix race while handling SYS_ERR at power up
2022-01-27 11:02:58 +01:00
cdrom
…
char
tpm: fix NPE on probe for missing device
2022-01-27 11:05:07 +01:00
clk
clk: si5341: Fix clock HW provider cleanup
2022-01-27 11:05:31 +01:00
clocksource
clocksource/drivers/dw_apb_timer_of: Fix probe failure
2021-12-14 10:57:23 +01:00
comedi
comedi: vmk80xx: fix bulk and interrupt message timeouts
2021-11-12 15:05:51 +01:00
connector
…
counter
…
cpufreq
cpufreq: Fix initialization of min and max frequency QoS requests
2022-01-27 11:04:44 +01:00
cpuidle
cpuidle: Fix kobject memory leaks in error paths
2021-11-18 19:16:29 +01:00
crypto
crypto: octeontx2 - uninitialized variable in kvf_limits_store()
2022-01-27 11:05:30 +01:00
cxl
cxl/pmem: Fix reference counting for delayed work
2022-01-27 11:02:58 +01:00
dax
…
dca
…
devfreq
…
dio
…
dma
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
2022-01-27 11:05:38 +01:00
dma-buf
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
2022-01-27 11:02:59 +01:00
edac
EDAC/synopsys: Use the quirk for version instead of ddr version
2022-01-27 11:04:28 +01:00
eisa
…
extcon
…
firewire
…
firmware
firmware: Update Kconfig help text for Google firmware
2022-01-27 11:05:19 +01:00
fpga
fpga: ice40-spi: Add SPI device ID table
2021-09-27 14:00:41 -07:00
fsi
…
gnss
…
gpio
gpio: idt3243x: Fix IRQ check in idt_gpio_probe
2022-01-27 11:05:31 +01:00
gpu
drm/vmwgfx: Fix stale file descriptors on failed usercopy
2022-01-29 10:58:25 +01:00
greybus
…
hid
HID: vivaldi: fix handling devices not using numbered reports
2022-01-27 11:05:34 +01:00
hsi
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 11:04:31 +01:00
hv
Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size
2021-11-25 09:48:46 +01:00
hwmon
hwmon: (mr75203) fix wrong power-up delay value
2022-01-27 11:03:48 +01:00
hwspinlock
…
hwtracing
coresight: trbe: Defer the probe on offline CPUs
2021-11-18 19:16:06 +01:00
i2c
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
2022-01-27 11:05:02 +01:00
i3c
…
idle
…
iio
iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046
2022-01-27 11:02:57 +01:00
infiniband
RDMA/rxe: Fix a typo in opcode name
2022-01-27 11:05:23 +01:00
input
Input: zinitix - make sure the IRQ is allocated before it gets enabled
2022-01-11 15:35:19 +01:00
interconnect
interconnect: qcom: rpm: Prevent integer overflow in rate
2022-01-27 11:05:00 +01:00
iommu
iommu/iova: Fix race between FQ timeout and teardown
2022-01-27 11:04:15 +01:00
ipack
ipack: ipoctal: fix module reference leak
2021-09-27 17:38:49 +02:00
irqchip
irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
2022-01-27 11:05:02 +01:00
isdn
mISDN: change function names to avoid conflicts
2022-01-11 15:35:18 +01:00
leds
leds: lp55xx: initialise output direction from dts
2022-01-27 11:04:21 +01:00
macintosh
…
mailbox
mailbox: change mailbox-mpfs compatible string
2022-01-27 11:05:05 +01:00
mcb
…
md
md: Move alloc/free acct bioset in to personality
2022-01-27 11:05:08 +01:00
media
media: correct MEDIA_TEST_SUPPORT help text
2022-01-27 11:05:20 +01:00
memory
memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
2022-01-27 11:03:11 +01:00
memstick
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-18 19:16:32 +01:00
message
…
mfd
mfd: tps65910: Set PWR_OFF bit during driver probe
2022-01-27 11:05:07 +01:00
misc
habanalabs: skip read fw errors if dynamic descriptor invalid
2022-01-27 11:05:04 +01:00
mmc
mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling
2022-01-27 11:04:50 +01:00
most
most: fix control-message timeouts
2021-11-18 19:16:08 +01:00
mtd
mtd: core: provide unique name for nvmem device
2022-01-27 11:03:26 +01:00
mux
…
net
bnx2x: Invalidate fastpath HSI version for VFs
2022-01-29 10:58:24 +01:00
nfc
NFC: st21nfca: Fix memory leak in device probe and remove
2022-01-05 12:42:36 +01:00
ntb
…
nubus
…
nvdimm
nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned
2021-11-18 19:17:07 +01:00
nvme
nvmet: use IOCB_NOWAIT only if the filesystem supports it
2021-12-01 09:04:52 +01:00
nvmem
nvmem: core: set size for sysfs bin file
2022-01-27 11:04:59 +01:00
of
of: base: Improve argument length mismatch error
2022-01-27 11:05:19 +01:00
opp
opp: Fix return in _opp_add_static_v2()
2021-11-18 19:17:00 +01:00
parisc
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
2022-01-27 11:05:28 +01:00
parport
…
pci
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
2022-01-27 11:05:14 +01:00
pcmcia
pcmcia: fix setting of kthread task states
2022-01-27 11:04:02 +01:00
perf
perf/arm-cmn: Fix CPU hotplug unregistration
2022-01-27 11:03:36 +01:00
phy
phy: mediatek: Fix missing check in mtk_mipi_tx_probe
2022-01-27 11:05:05 +01:00
pinctrl
pinctrl/rockchip: fix gpio device creation
2022-01-27 11:05:31 +01:00
platform
platform/x86/intel: hid: add quirk to support Surface Go 3
2022-01-16 09:12:45 +01:00
pnp
…
power
power: reset: mt6397: Check for null res pointer
2022-01-27 11:03:49 +01:00
powercap
…
pps
…
ps3
…
ptp
net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets
2022-01-27 11:03:52 +01:00
pwm
…
rapidio
…
ras
…
regulator
regulator: qcom_smd: Align probe function with rpmh-regulator
2022-01-27 11:04:54 +01:00
remoteproc
remoteproc: imx_rproc: Fix a resource leak in the remove function
2022-01-27 11:05:10 +01:00
reset
reset: renesas: Fix Runtime PM usage
2022-01-11 15:35:16 +01:00
rpmsg
rpmsg: core: Clean up resources on announce_create failure.
2022-01-27 11:05:06 +01:00
rtc
rtc: pxa: fix null pointer dereference
2022-01-27 11:05:34 +01:00
s390
s390/cio: make ccw_device_dma_* more robust
2021-11-18 19:17:18 +01:00
sbus
…
scsi
scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl()
2022-01-27 11:05:22 +01:00
sh
maple: fix wrong return value of maple_bus_init().
2021-11-25 09:48:31 +01:00
siox
…
slimbus
…
soc
PM: AVS: qcom-cpr: Use div64_ul instead of do_div
2022-01-27 11:04:46 +01:00
soundwire
soundwire: bus: stop dereferencing invalid slave pointer
2021-11-18 19:16:54 +01:00
spi
spi: uniphier: Fix a bug that doesn't point to private data correctly
2022-01-27 11:05:08 +01:00
spmi
…
ssb
…
staging
media: atomisp: fix "variable dereferenced before check 'asd'"
2022-01-27 11:04:36 +01:00
target
scsi: target: Fix alua_tg_pt_gps_count tracking
2021-11-25 09:48:29 +01:00
tc
…
tee
tee: fix put order in teedev_close_context()
2022-01-27 11:03:12 +01:00
thermal
thermal/drivers/imx8mm: Enable ADC when enabling monitor
2022-01-27 11:03:23 +01:00
thunderbolt
thunderbolt: Runtime PM activate both ends of the device link
2022-01-27 11:04:36 +01:00
tty
serial: Fix incorrect rs485 polarity on uart open
2022-01-27 11:05:09 +01:00
uio
…
usb
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
2022-01-27 11:04:44 +01:00
vdpa
vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps()
2022-01-27 11:05:36 +01:00
vfio
…
vhost
vdpa: check that offsets are within bounds
2021-12-22 09:32:36 +01:00
video
backlight: qcom-wled: Respect enabled-strings in set_brightness
2022-01-27 11:03:46 +01:00
virt
nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert
2022-01-05 12:42:39 +01:00
virtio
virtio_ring: mark ring unused on error
2022-01-27 11:05:35 +01:00
visorbus
…
vlynq
…
vme
…
w1
w1: Misuse of get_user()/put_user() reported by sparse
2022-01-27 11:04:59 +01:00
watchdog
ar7: fix kernel builds for compiler test
2021-11-18 19:17:03 +01:00
xen
xen/gntdev: fix unmap notification order
2022-01-27 11:05:08 +01:00
zorro
…
Kconfig
firmware: include drivers/firmware/Kconfig unconditionally
2021-10-07 16:51:26 +02:00
Makefile
virtio: always enter drivers/virtio/
2021-12-22 09:32:39 +01:00