TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Sumit Semwal cc7bbb97e5 dma-buf: Move dma_buf_release() from fops to dentry_ops 
commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream.

Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which
happens if the dma_buf_release() is called while the userspace is
accessing the dma_buf pseudo fs's dmabuffs_dname() in another process,
and dma_buf_release() releases the dmabuf object when the last reference
to the struct file goes away.

I discussed with Arnd Bergmann, and he suggested that rather than tying
the dma_buf_release() to the file_operations' release(), we can tie it to
the dentry_operations' d_release(), which will be called when the last ref
to the dentry is removed.

The path exercised by __fput() calls f_op->release() first, and then calls
dput, which eventually calls d_op->d_release().

In the 'normal' case, when no userspace access is happening via dma_buf
pseudo fs, there should be exactly one fd, file, dentry and inode, so
closing the fd will kill of everything right away.

In the presented case, the dentry's d_release() will be called only when
the dentry's last ref is released.

Therefore, lets move dma_buf_release() from fops->release() to
d_ops->d_release()

Many thanks to Arnd for his FS insights :)

[1]: https://lore.kernel.org/patchwork/patch/1238278/

Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")
Reported-by: syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> [5.3+]
Cc: Arnd Bergmann <arnd@arndb.de>
Reported-by: Charan Teja Reddy <charante@codeaurora.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Tested-by: Charan Teja Reddy <charante@codeaurora.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200611114418.19852-1-sumit.semwal@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-03-16 16:31:22 +08:00
..
accessibility Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
acpi ACPI: configfs: Disallow loading ACPI tables when locked down 2021-03-16 16:31:07 +08:00
amba Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
android binder: fix null deref of proc->context 2021-03-16 16:30:50 +08:00
ata ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function 2021-03-16 16:31:03 +08:00
atm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
auxdisplay Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
base regmap: Fix memory leak from regmap_register_patch 2021-03-16 16:30:57 +08:00
bcma Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
block virtio-blk: free vblk-vqs in error path of virtblk_probe() 2021-03-16 16:31:19 +08:00
bluetooth Bluetooth: hci_bcm: fix freeing not-requested IRQ 2021-03-16 16:29:45 +08:00
bus bus: ti-sysc: Ignore clockactivity unless specified as a quirk 2021-03-16 16:30:55 +08:00
cdrom Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
char tpm: Fix TIS locality timeout problems 2021-03-16 16:31:16 +08:00
clk clk: sifive: allocate sufficient memory for struct __prci_data 2021-03-16 16:31:02 +08:00
clocksource clocksource: dw_apb_timer_of: Fix missing clockevent timers 2021-03-16 16:29:20 +08:00
connector Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
counter counter: 104-quad-8: Add lock guards - generic interface 2021-03-16 16:27:07 +08:00
cpufreq cpufreq: Fix up cpufreq_boost_set_sw() 2021-03-16 16:29:08 +08:00
cpuidle cpuidle: Fix three reference count leaks 2021-03-16 16:29:37 +08:00
crypto crypto: omap-sham - add proper load balancing support for multicore 2021-03-16 16:30:29 +08:00
dax device-dax: don't leak kernel memory to user space after unloading kmem 2021-03-16 16:28:19 +08:00
dca Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
devfreq PM / devfreq: Add missing locking while setting suspend_freq 2021-03-16 16:27:31 +08:00
dio Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dma dmaengine: owl: Use correct lock in owl_dma_get_pchan() 2021-03-16 16:28:16 +08:00
dma-buf dma-buf: Move dma_buf_release() from fops to dentry_ops 2021-03-16 16:31:22 +08:00
edac EDAC/amd64: Read back the scrub rate PCI register on F15h 2021-03-16 16:31:13 +08:00
eisa Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
extcon extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()' 2021-03-16 16:30:26 +08:00
firewire Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
firmware efi/esrt: Fix reference count leak in esre_create_sysfs_entry. 2021-03-16 16:30:56 +08:00
fpga fpga: dfl: afu: Corrected error handling levels 2021-03-16 16:30:19 +08:00
fsi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
gnss gnss: sirf: fix error return code in sirf_probe() 2021-03-16 16:29:47 +08:00
gpio gpio: pca953x: fix handling of automatic address incrementing 2021-03-16 16:30:11 +08:00
gpu drm/amdgpu/atomfirmware: fix vram_info fetching for renoir 2021-03-16 16:31:22 +08:00
greybus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hid HID: Add quirks for Trust Panora Graphic Tablet 2021-03-16 16:30:17 +08:00
hsi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hv Drivers: hv: vmbus: Always handle the VMBus messages on CPU0 2021-03-16 16:29:25 +08:00
hwmon hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() 2021-03-16 16:31:18 +08:00
hwspinlock Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hwtracing coresight: tmc: Fix TMC mode read in tmc_read_prepare_etb() 2021-03-16 16:30:02 +08:00
i2c i2c: mlxcpld: check correct size of maximum RECV_LEN packet 2021-03-16 16:31:20 +08:00
i3c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ide Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
idle Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
iio iio: bmp280: fix compensation of humidity 2021-03-16 16:29:58 +08:00
infiniband RDMA/counter: Query a counter before release 2021-03-16 16:31:17 +08:00
input input: i8042 - Remove special PowerPC handling 2021-03-16 16:30:26 +08:00
interconnect Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
iommu iommu/vt-d: Update scalable mode paging structure coherency 2021-03-16 16:30:59 +08:00
ipack ipack: tpci200: fix error return code in tpci200_register() 2021-03-16 16:28:19 +08:00
irqchip irqchip/mbigen: Free msi_desc on device teardown 2021-03-16 16:26:29 +08:00
isdn Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
leds leds: core: Fix warning message when init_data 2021-03-16 16:26:37 +08:00
lightnvm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
macintosh drivers/macintosh: Fix memleak in windfarm_pm112 driver 2021-03-16 16:29:49 +08:00
mailbox mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe() 2021-03-16 16:30:27 +08:00
mcb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
md dm writecache: add cond_resched to loop in persistent_memory_claim() 2021-03-16 16:31:13 +08:00
media media: ov5640: fix use of destroyed mutex 2021-03-16 16:29:45 +08:00
memory Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
memstick Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
message Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mfd mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt 2021-03-16 16:30:24 +08:00
misc misc: xilinx-sdfec: improve get_user_pages_fast() error handling 2021-03-16 16:30:25 +08:00
mmc mmc: sdhci-esdhc-imx: fix the mask for tuning start point 2021-03-16 16:29:36 +08:00
mtd mtd: rawnand: tmio: Fix the probe error path 2021-03-16 16:29:53 +08:00
mux Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
net cxgb4: fix SGE queue dump destination buffer context 2021-03-16 16:31:18 +08:00
nfc NFC: st21nfca: add missed kfree_skb() in an error path 2021-03-16 16:28:49 +08:00
ntb NTB: perf: Fix race condition when run with ntb_test 2021-03-16 16:30:32 +08:00
nubus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nvdimm libnvdimm: Out of bounds read in __nd_ioctl() 2021-03-16 16:26:40 +08:00
nvme nvme: fix a crash in nvme_mpath_add_disk 2021-03-16 16:31:19 +08:00
nvmem nvmem: qfprom: remove incorrect write support 2021-03-16 16:28:52 +08:00
of of: Fix a refcounting bug in __of_attach_node_sysfs() 2021-03-16 16:30:26 +08:00
opp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
oprofile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
parisc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
parport Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pci PCI: amlogic: meson: Don't use FAST_LINK_MODE to set up link 2021-03-16 16:30:22 +08:00
pcmcia Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
perf drivers/perf: hisi: Fix wrong value for all counters enable 2021-03-16 16:30:32 +08:00
phy drivers: phy: sr-usb: do not use internal fsm for USB2 phy init 2021-03-16 16:30:18 +08:00
pinctrl pinctrl: tegra: Use noirq suspend/resume callbacks 2021-03-16 16:31:05 +08:00
platform platform/x86: asus_wmi: Reserve more space for struct bias_args 2021-03-16 16:29:37 +08:00
pnp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
power power: supply: smb347-charger: IRQSTAT_D is volatile 2021-03-16 16:30:14 +08:00
powercap Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pps Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ps3 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ptp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pwm pwm: jz4740: Enhance precision in calculation of duty cycle 2021-03-16 16:30:44 +08:00
rapidio rapidio: fix an error in get_user_pages_fast() error handling 2021-03-16 16:28:19 +08:00
ras Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
regulator regualtor: pfuze100: correct sw1a/sw2 on pfuze3000 2021-03-16 16:30:56 +08:00
remoteproc remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use 2021-03-16 16:29:59 +08:00
reset Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rpmsg Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rtc rtc: rv3028: Add missed check for devm_regmap_init_i2c() 2021-03-16 16:30:27 +08:00
s390 s390/qeth: fix error handling for isolation mode cmds 2021-03-16 16:30:59 +08:00
sbus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
scsi scsi: lpfc: Avoid another null dereference in lpfc_sli4_hba_unset() 2021-03-16 16:31:01 +08:00
sfi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sh Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
siox Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
slimbus slimbus: ngd: get drvdata from correct device 2021-03-16 16:30:11 +08:00
soc soc/tegra: pmc: Select GENERIC_PINCONF 2021-03-16 16:29:49 +08:00
soundwire soundwire: slave: don't init debugfs on device registration error 2021-03-16 16:30:12 +08:00
spi spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths 2021-03-16 16:31:20 +08:00
spmi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ssb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
staging Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate() 2021-03-16 16:31:11 +08:00
target scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd() 2021-03-16 16:30:24 +08:00
tc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tee Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
thermal thermal/drivers/rcar_gen3: Fix undefined temperature if negative 2021-03-16 16:31:18 +08:00
thunderbolt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tty Revert "tty: hvc: Fix data abort due to race in hvc_open" 2021-03-16 16:31:13 +08:00
uio Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
usb usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect 2021-03-16 16:31:14 +08:00
vfio vfio/mdev: Fix reference count leak in add_mdev_supported_type 2021-03-16 16:30:27 +08:00
vhost scsi: vhost: Notify TCM about the maximum sg entries supported per command 2021-03-16 16:30:04 +08:00
video backlight: lp855x: Ensure regulators are disabled on probe failure 2021-03-16 16:29:56 +08:00
virt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
virtio Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
visorbus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vlynq Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vme Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
w1 w1: omap-hdq: cleanup to add missing newline for some dev_dbg 2021-03-16 16:29:53 +08:00
watchdog watchdog: da9062: No need to ping manually before setting timeout 2021-03-16 16:30:22 +08:00
xen xen/pvcalls-back: test for errors when calling backend_connect() 2021-03-16 16:29:13 +08:00
zorro Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00