TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Sakari Ailus 7a3c10f3d4 media: v4l: ioctl: Fix memory leak in video_usercopy 
commit fb18802a338b36f675a388fc03d2aa504a0d0899 upstream.

When an IOCTL with argument size larger than 128 that also used array
arguments were handled, two memory allocations were made but alas, only
the latter one of them was released. This happened because there was only
a single local variable to hold such a temporary allocation.

Fix this by adding separate variables to hold the pointers to the
temporary allocations.

Reported-by: Arnd Bergmann <arnd@kernel.org>
Reported-by: syzbot+1115e79c8df6472c612b@syzkaller.appspotmail.com
Fixes: d14e6d76ebf7 ("[media] v4l: Add multi-planar ioctl handling code")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-04-12 12:52:50 +08:00
..
accessibility
…
acpi ACPI: configfs: add missing check after configfs_register_default_group() 2021-04-12 12:52:32 +08:00
amba amba: Fix resource leak for drivers without .remove 2021-04-12 12:52:26 +08:00
android binder: add flag to clear buffer on txn complete 2021-03-16 16:43:28 +08:00
ata ata: ahci_brcm: Add back regulators management 2021-04-12 12:52:20 +08:00
atm atm: idt77252: call pci_disable_device() on error path 2021-04-12 12:51:07 +08:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-04-12 12:52:25 +08:00
base regmap: sdw: use _no_pm functions in regmap_read/write 2021-04-12 12:52:31 +08:00
bcma
…
block zsmalloc: account the number of compacted pages correctly 2021-04-12 12:52:50 +08:00
bluetooth Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl 2021-04-12 12:52:46 +08:00
bus bus: fsl-mc: fix error return code in fsl_mc_object_allocate() 2021-03-16 16:43:09 +08:00
cdrom
…
char tpm_tis: Clean up locality release 2021-04-12 12:52:35 +08:00
clk clk: aspeed: Fix APLL calculate formula from ast2600-A2 2021-04-12 12:52:28 +08:00
clocksource clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined 2021-04-12 12:52:24 +08:00
connector
…
counter
…
cpufreq cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available 2021-04-12 12:52:40 +08:00
cpuidle cpuidle: Fixup IRQ state 2021-03-16 16:35:25 +08:00
crypto crypto: sun4i-ss - initialize need_fallback 2021-04-12 12:52:36 +08:00
dax device-dax/core: Fix memory leak when rmmod dax.ko 2021-03-16 16:43:45 +08:00
dca
…
devfreq PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out 2021-03-16 16:36:35 +08:00
dio
…
dma dmaengine: hsu: disable spurious interrupt 2021-04-12 12:52:24 +08:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-04-12 12:51:14 +08:00
edac EDAC/amd64: Fix PCI component registration 2021-03-16 16:43:29 +08:00
eisa
…
extcon extcon: max77693: Fix modalias string 2021-03-16 16:43:12 +08:00
firewire
…
firmware firmware: imx: select SOC_BUS to fix firmware build 2021-04-12 12:51:46 +08:00
fpga
…
fsi
…
gnss
…
gpio gpio: pcf857x: Fix missing first interrupt 2021-04-12 12:52:39 +08:00
gpu drm/amd/display: Guard against NULL pointer deref when get_i2c_info fails 2021-04-12 12:52:47 +08:00
greybus
…
hid HID: wacom: Ignore attempts to overwrite the touch_max value from HID 2021-04-12 12:52:32 +08:00
hsi HSI: Fix PM usage counter unbalance in ssi_hw_init 2021-04-12 12:52:22 +08:00
hv Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() 2021-04-12 12:52:21 +08:00
hwmon hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values 2021-04-12 12:51:24 +08:00
hwspinlock
…
hwtracing stm class: Fix module init return on allocation failure 2021-04-12 12:51:37 +08:00
i2c i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition 2021-04-12 12:52:32 +08:00
i3c i3c master: fix missing destroy_workqueue() on error in i3c_master_register 2021-03-16 16:43:55 +08:00
ide scsi: ide: Do not set the RQF_PREEMPT flag for sense requests 2021-04-12 12:51:06 +08:00
idle
…
iio iio: ad5504: Fix setting power-down state 2021-04-12 12:51:37 +08:00
infiniband RDMA/hns: Fixes missing error code of CMDQ 2021-04-12 12:52:29 +08:00
input Input: elantech - fix protocol errors for some trackpoints in SMBus mode 2021-04-12 12:52:43 +08:00
interconnect interconnect: qcom: qcs404: Remove GPU and display RPM IDs 2021-03-16 16:42:11 +08:00
iommu iommu/vt-d: Do not use flush-queue when caching-mode is on 2021-04-12 12:51:57 +08:00
ipack
…
irqchip irqchip/mips-cpu: Set IPI domain parent chip 2021-04-12 12:51:37 +08:00
isdn misdn: dsp: select CONFIG_BITREVERSE 2021-04-12 12:51:24 +08:00
leds leds: trigger: fix potential deadlock with libata 2021-04-12 12:51:44 +08:00
lightnvm lightnvm: fix memory leak when submit fails 2021-04-12 12:51:39 +08:00
macintosh macintosh/via-macii: Access autopoll_devs when inside lock 2021-03-16 16:33:39 +08:00
mailbox mailbox: avoid timer start from callback 2021-03-16 16:38:59 +08:00
mcb
…
md dm era: Update in-core bitset after committing the metadata 2021-04-12 12:52:42 +08:00
media media: v4l: ioctl: Fix memory leak in video_usercopy 2021-04-12 12:52:50 +08:00
memory memory: ti-aemif: Drop child node when jumping out loop 2021-04-12 12:52:13 +08:00
memstick memstick: r592: Fix error return in r592_probe() 2021-03-16 16:43:02 +08:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2021-03-16 16:39:58 +08:00
mfd mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() 2021-04-12 12:52:27 +08:00
misc drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue 2021-04-12 12:52:36 +08:00
mmc mmc: sdhci-esdhc-imx: fix kernel panic when remove module 2021-04-12 12:52:39 +08:00
mtd mtd: spi-nor: hisi-sfc: Put child node np on error path 2021-04-12 12:52:38 +08:00
mux
…
net xen-netback: respect gnttab_map_refs()'s return value 2021-04-12 12:52:50 +08:00
nfc nfc: s3fwrn5: Release the nfc firmware 2021-03-16 16:43:15 +08:00
ntb NTB: hw: amd: fix an issue about leak system resources 2021-03-16 16:39:10 +08:00
nubus
…
nvdimm libnvdimm/dimm: Avoid race between probe and available_slots_show() 2021-04-12 12:51:55 +08:00
nvme nvme-tcp: add clean action for failed reconnection 2021-04-12 12:52:48 +08:00
nvmem nvmem: core: skip child nodes not matching binding 2021-04-12 12:52:30 +08:00
of of/fdt: Make sure no-map does not remove already reserved regions 2021-04-12 12:52:24 +08:00
opp opp: Reduce the size of critical section in _opp_table_kref_release() 2021-03-16 16:40:41 +08:00
oprofile
…
parisc parisc: mask out enable and reserved bits from sba imask 2021-03-16 16:33:54 +08:00
parport
…
pci PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse 2021-04-12 12:52:47 +08:00
pcmcia
…
perf drivers/perf: thunderx2_pmu: Fix memory resource error handling 2021-03-16 16:38:23 +08:00
phy phy: rockchip-emmc: emmc_phy_init() always return 0 2021-04-12 12:52:29 +08:00
pinctrl pinctrl: ingenic: Fix JZ4760 support 2021-04-12 12:51:38 +08:00
platform platform/x86: hp-wmi: Disable tablet-mode reporting by default 2021-04-12 12:52:01 +08:00
pnp
…
power power: reset: at91-sama5d2_shdwc: fix wkupdbc mask 2021-04-12 12:52:24 +08:00
powercap powercap: restrict energy meter to root access 2021-03-16 16:40:32 +08:00
pps
…
ps3 powerpc/ps3: use dma_mapping_error() 2021-03-16 16:43:15 +08:00
ptp
…
pwm pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() 2021-04-12 12:52:30 +08:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2021-03-16 16:38:59 +08:00
ras
…
regulator regulator: qcom-rpmh: fix pm8009 ldo7 2021-04-12 12:52:28 +08:00
remoteproc remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() 2021-03-16 16:43:11 +08:00
reset
…
rpmsg rpmsg: glink: Use complete_all for open states 2021-03-16 16:39:50 +08:00
rtc rtc: s5m: select REGMAP_I2C 2021-04-12 12:52:24 +08:00
s390 virtio/s390: implement virtio-ccw revision 2 correctly 2021-04-12 12:52:40 +08:00
sbus
…
scsi scsi: iscsi: Verify lengths on passthrough PDUs 2021-04-12 12:52:49 +08:00
sfi
…
sh
…
siox
…
slimbus slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI 2021-03-16 16:42:54 +08:00
soc soc: aspeed: snoop: Add clock control logic 2021-04-12 12:52:15 +08:00
soundwire soundwire: cadence: fix ACK/NAK handling 2021-04-12 12:52:29 +08:00
spi spi: spi-synquacer: fix set_cs handling 2021-04-12 12:52:40 +08:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-04-12 12:52:39 +08:00
ssb
…
staging staging: bcm2835-audio: Replace unsafe strcpy() with strscpy() 2021-04-12 12:52:47 +08:00
target cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds 2021-04-12 12:52:16 +08:00
tc
…
tee tee: optee: replace might_sleep with cond_resched 2021-04-12 12:51:45 +08:00
thermal thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed 2021-03-16 16:43:48 +08:00
thunderbolt thunderbolt: Fix use-after-free in remove_unplugged_switch() 2021-03-16 16:42:03 +08:00
tty vt/consolemap: do font sum unsigned 2021-04-12 12:52:46 +08:00
uio uio: avoid to request_irq when the legacy irq is not connected 2021-03-16 16:43:58 +08:00
usb USB: serial: mos7720: fix error code in mos7720_write() 2021-04-12 12:52:33 +08:00
vfio vfio/type1: Use follow_pte() 2021-04-12 12:52:31 +08:00
vhost vhost_net: fix ubuf refcount incorrectly when sendmsg fails 2021-04-12 12:51:09 +08:00
video udlfb: Fix memory leak in dlfb_usb_probe 2021-04-12 12:52:43 +08:00
virt virt: vbox: Do not use wait_event_interruptible when called from kernel context 2021-04-12 12:52:10 +08:00
virtio virtio_ring: Fix two use after free bugs 2021-03-16 16:43:19 +08:00
visorbus
…
vlynq
…
vme
…
w1 w1: mxc_w1: Fix timeout resolution problem leading to bus error 2021-03-16 16:39:58 +08:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-04-12 12:52:38 +08:00
xen xen-scsiback: don't "handle" error by BUG() 2021-04-12 12:52:08 +08:00
zorro
…
Kconfig
…
Makefile
…