Mathias Krause
84b1259fe3
drm/vmwgfx: Fix stale file descriptors on failed usercopy ...
commit a0f90c8815706981c483a652a6aefca51a5e191c upstream.
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.
Fixes: c906965dee
2022-01-29 10:25:11 +01:00
ACPI: battery: Add the ThinkPad "Not Charging" quirk
2022-01-27 09:19:45 +01:00
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-06 13:59:45 +01:00
binder: fix handling of error during copy
2022-01-27 09:19:38 +01:00
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
2021-12-22 09:29:39 +01:00
atm: nicstar: register the interrupt handler in the right place
2021-07-19 08:53:12 +02:00
auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-17 09:48:45 +01:00
devtmpfs regression fix: reconfigure on each mount
2022-01-20 09:19:17 +01:00
bcma: Fix memory leak for internally-handled cores
2021-09-15 09:47:37 +02:00
floppy: Add max size check for user space request
2022-01-27 09:19:42 +01:00
Bluetooth: hci_bcm: Check for error irq
2022-01-27 09:19:36 +01:00
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
2021-10-13 10:08:19 +02:00
cdrom: gdrom: initialize global variable at init time
2021-05-26 12:05:19 +02:00
random: do not throw away excess input to crng_fast_load
2022-01-27 09:19:46 +01:00
clk: si5341: Fix clock HW provider cleanup
2022-01-27 09:19:53 +01:00
clocksource/drivers/timer-ti-dm: Select TIMER_OF
2021-11-17 09:48:39 +01:00
counter: 104-quad-8: Return error when invalid mode during ceiling_write
2021-09-15 09:47:34 +02:00
cpufreq: Fix initialization of min and max frequency QoS requests
2022-01-27 09:19:44 +01:00
cpuidle: Fix kobject memory leaks in error paths
2021-11-17 09:48:36 +01:00
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
2022-01-27 09:19:49 +01:00
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
2022-01-27 09:19:55 +01:00
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
2022-01-27 09:19:28 +01:00
EDAC/synopsys: Use the quirk for version instead of ddr version
2022-01-27 09:19:41 +01:00
extcon: intel-mrfld: Sync hardware and software state on init
2021-07-19 08:53:16 +02:00
firmware: Update Kconfig help text for Google firmware
2022-01-27 09:19:51 +01:00
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
2021-09-30 10:09:23 +02:00
fsi/sbefifo: Fix reset timeout
2021-07-14 16:53:42 +02:00
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
2022-01-27 09:19:43 +01:00
drm/vmwgfx: Fix stale file descriptors on failed usercopy
2022-01-29 10:25:11 +01:00
HID: quirks: Allow inverting the absolute X/Y values
2022-01-27 09:19:43 +01:00
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 09:19:41 +01:00
hyperv/vmbus: include linux/bitops.h
2021-11-17 09:48:20 +01:00
hwmon: (lm90) Do not report 'busy' status bit as alarm
2021-12-29 12:23:37 +01:00
intel_th: Wait until port is in reset before programming it
2021-07-20 16:10:46 +02:00
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
2022-01-27 09:19:48 +01:00
iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
2021-12-22 09:29:35 +01:00
RDMA/rxe: Fix a typo in opcode name
2022-01-27 09:19:52 +01:00
Input: touchscreen - Fix backport of a02dcde595f7cbd240ccd64de96034ad91cffc40
2022-01-11 15:23:30 +01:00
iommu/iova: Fix race between FQ timeout and teardown
2022-01-27 09:19:39 +01:00
ipack: ipoctal: fix module reference leak
2021-10-06 15:42:36 +02:00
irqchip: nvic: Fix offset for Interrupt Priority Offsets
2021-12-14 14:49:06 +01:00
mISDN: change function names to avoid conflicts
2022-01-11 15:23:33 +01:00
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
2021-09-15 09:47:33 +02:00
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:09:22 +02:00
dm space map common: add bounds check to sm_ll_lookup_bitmap()
2022-01-27 09:19:46 +01:00
media: rcar-csi2: Optimize the selection PHTW register
2022-01-27 09:19:51 +01:00
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
2021-11-17 09:48:42 +01:00
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-17 09:48:37 +01:00
mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
2022-01-16 09:15:38 +01:00
misc: lattice-ecp3-config: Fix task hung when firmware load failed
2022-01-27 09:19:39 +01:00
mmc: sdhci-esdhc-imx: disable CMDQ support
2022-01-29 10:25:11 +01:00
mtd: nand: bbt: Fix corner case in bad block table handling
2022-01-27 09:19:55 +01:00
lib82596: Fix IRQ check in sni_82596_probe
2022-01-27 09:19:55 +01:00
NFC: st21nfca: Fix memory leak in device probe and remove
2022-01-05 12:37:44 +01:00
NTB: perf: Fix an error code in perf_setup_inbuf()
2021-09-22 12:26:44 +02:00
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
2021-10-06 15:42:38 +02:00
nvmet: use IOCB_NOWAIT only if the filesystem supports it
2021-12-01 09:23:33 +01:00
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-20 11:40:14 +02:00
of: base: Improve argument length mismatch error
2022-01-27 09:19:51 +01:00
opp: Fix return in _opp_add_static_v2()
2021-11-17 09:48:44 +01:00
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
2022-01-27 09:19:53 +01:00
parport: remove non-zero check on count
2021-09-22 12:26:36 +02:00
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
2022-01-27 09:19:50 +01:00
pcmcia: fix setting of kthread task states
2022-01-27 09:19:37 +01:00
drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe()
2021-07-14 16:53:14 +02:00
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
2022-01-27 09:19:39 +01:00
pinctrl: bcm2835: Change init order for gpio hogs
2022-01-29 10:25:10 +01:00
platform/x86: apple-gmux: use resource_size() with res
2022-01-05 12:37:43 +01:00
power: bq25890: Enable continuous conversion for ADC at charging
2022-01-27 09:19:49 +01:00
ptp_pch: Load module automatically if ID matches
2021-10-13 10:08:19 +02:00
pwm: stm32-lp: Don't modify HW state in .remove() callback
2021-09-26 14:07:13 +02:00
rapidio: handle create_workqueue() failure
2021-05-26 12:05:17 +02:00
regulator: qcom_smd: Align probe function with rpmh-regulator
2022-01-27 09:19:46 +01:00
reset: socfpga: add empty driver allowing consumers to probe
2021-11-17 09:48:20 +01:00
rpmsg: core: Clean up resources on announce_create failure.
2022-01-27 09:19:49 +01:00
rtc: pxa: fix null pointer dereference
2022-01-27 09:19:53 +01:00
s390/cio: make ccw_device_dma_* more robust
2021-11-17 09:48:50 +01:00
scsi: core: Show SCMD_LAST in text form
2022-01-27 09:19:52 +01:00
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:47:17 +01:00
slimbus: ngd: reset dma setup during runtime pm
2021-08-26 08:36:21 -04:00
ASoC: mediatek: Check for error clk pointer
2022-01-27 09:19:39 +01:00
soundwire: stream: Fix test for DP prepare complete
2021-07-14 16:53:45 +02:00
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
2022-01-27 09:19:37 +01:00
ssb: Fix error return code in ssb_bus_scan()
2021-07-14 16:53:29 +02:00
staging: greybus: audio: Check null pointer
2022-01-27 09:19:36 +01:00
scsi: target: Fix alua_tg_pt_gps_count tracking
2021-11-26 10:47:16 +01:00
tee: fix put order in teedev_close_context()
2022-01-27 09:19:30 +01:00
thermal: core: Reset previous low and high trip during thermal zone init
2021-12-08 09:01:09 +01:00
thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
2021-06-03 08:59:03 +02:00
serial: Fix incorrect rs485 polarity on uart open
2022-01-27 09:19:49 +01:00
uio_hv_generic: Fix a memory leak in error handling paths
2021-05-26 12:05:17 +02:00
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
2022-01-27 09:19:44 +01:00
vfio: Use config not menuconfig for VFIO_NOIOMMU
2021-09-22 12:26:23 +02:00
vhost/vsock: fix incorrect used length reported to the guest
2021-12-01 09:23:34 +01:00
vgacon: Propagate console boot parameters before calling `vc_resize'
2021-12-08 09:01:13 +01:00
virtio_ring: Fix querying of maximum DMA mapping size for virtio device
2021-12-22 09:29:34 +01:00
visorbus: fix error return code in visorchipset_init()
2021-07-14 16:53:42 +02:00
w1: Misuse of get_user()/put_user() reported by sparse
2022-01-27 09:19:48 +01:00
ar7: fix kernel builds for compiler test
2021-11-17 09:48:46 +01:00
xen: detect uninitialized xenbus in xenbus_init
2021-12-01 09:23:28 +01:00
84b1259fe3