A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/drivers
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Zheyu Ma 1248582e47 can: peak_pci: peak_pci_remove(): fix UAF 
commit 949fe9b35570361bc6ee2652f89a0561b26eec98 upstream.

When remove the module peek_pci, referencing 'chan' again after
releasing 'dev' will cause UAF.

Fix this by releasing 'dev' later.

The following log reveals it:

[   35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537
[   35.965513 ] Call Trace:
[   35.965718 ]  dump_stack_lvl+0xa8/0xd1
[   35.966028 ]  print_address_description+0x87/0x3b0
[   35.966420 ]  kasan_report+0x172/0x1c0
[   35.966725 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967137 ]  ? trace_irq_enable_rcuidle+0x10/0x170
[   35.967529 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967945 ]  __asan_report_load8_noabort+0x14/0x20
[   35.968346 ]  peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.968752 ]  pci_device_remove+0xa9/0x250

Fixes: e6d9c80b7c ("can: peak_pci: add support of some new PEAK-System PCI cards")
Link: https://lore.kernel.org/all/1634192913-15639-1-git-send-email-zheyuma97@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-27 09:54:26 +02:00
..
accessibility
acpi acpi/arm64: fix next_platform_timer() section mismatch error 2021-10-20 11:40:17 +02:00
amba
android binder: make sure fd closes complete 2021-09-30 10:09:21 +02:00
ata ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() 2021-10-20 11:40:16 +02:00
atm atm: nicstar: register the interrupt handler in the right place 2021-07-19 08:53:12 +02:00
auxdisplay
base PM: base: power: don't try to use non-existing RTC for storing data 2021-09-22 12:26:39 +02:00
bcma bcma: Fix memory leak for internally-handled cores 2021-09-15 09:47:37 +02:00
block Revert "block: nbd: add sanity check for first_minor" 2021-09-16 12:56:13 +02:00
bluetooth Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. 2021-07-19 08:53:13 +02:00
bus bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 2021-10-13 10:08:19 +02:00
cdrom
char tpm_ftpm_tee: Free and unregister TEE shared memory during kexec 2021-08-12 13:21:01 +02:00
clk clk: at91: clk-generated: Limit the requested rate to our range 2021-09-22 12:26:25 +02:00
clocksource clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel 2021-09-15 09:47:29 +02:00
connector
counter counter: 104-quad-8: Return error when invalid mode during ceiling_write 2021-09-15 09:47:34 +02:00
cpufreq cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory 2021-10-06 15:42:30 +02:00
cpuidle
crypto crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() 2021-10-06 15:42:39 +02:00
dax
dca
devfreq
dio
dma dmaengine: xilinx_dma: Set DMA mask for coherent APIs 2021-09-26 14:07:11 +02:00
dma-buf dma-buf/sync_file: Don't leak fences on merge failure 2021-07-25 14:35:15 +02:00
edac EDAC/armada-xp: Fix output of uncorrectable error counter 2021-10-20 11:40:14 +02:00
eisa
extcon extcon: intel-mrfld: Sync hardware and software state on init 2021-07-19 08:53:16 +02:00
firewire
firmware efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() 2021-10-20 11:40:14 +02:00
fpga fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 2021-09-30 10:09:23 +02:00
fsi fsi/sbefifo: Fix reset timeout 2021-07-14 16:53:42 +02:00
gnss
gpio gpio: pca953x: Improve bias setting 2021-10-20 11:40:15 +02:00
gpu drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling 2021-10-20 11:40:17 +02:00
greybus
hid HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs 2021-10-17 10:42:33 +02:00
hsi
hv
hwmon hwmon: (tmp421) fix rounding for negative values 2021-10-06 15:42:33 +02:00
hwspinlock
hwtracing intel_th: Wait until port is in reset before programming it 2021-07-20 16:10:46 +02:00
i2c i2c: acpi: fix resource leak in reconfiguration device addition 2021-10-13 10:08:20 +02:00
i3c
ide
idle
iio iio: dac: ti-dac5571: fix an error code in probe() 2021-10-20 11:40:15 +02:00
infiniband RDMA/efa: Remove double QP type assignment 2021-09-22 12:26:23 +02:00
input Input: xpad - add support for another USB ID of Nacon GC-100 2021-10-20 11:40:14 +02:00
interconnect
iommu iommu: Check if group is NULL before remove device 2021-08-26 08:36:15 -04:00
ipack ipack: ipoctal: fix module reference leak 2021-10-06 15:42:36 +02:00
irqchip irqchip/gic-v3-its: Fix potential VPE leak on error 2021-09-30 10:09:24 +02:00
isdn mISDN: fix possible use-after-free in HFC_cleanup() 2021-07-19 08:53:08 +02:00
leds leds: trigger: audio: Add an activate callback to ensure the initial brightness is set 2021-09-15 09:47:33 +02:00
lightnvm
macintosh
mailbox
mcb mcb: fix error handling in mcb_alloc_bus() 2021-09-30 10:09:22 +02:00
md md: fix a lock order reversal in md_alloc 2021-09-30 10:09:24 +02:00
media media: tegra-cec: Handle errors of clk_prepare_enable() 2021-09-22 12:26:31 +02:00
memory memory: fsl_ifc: fix leak of private memory on probe failure 2021-07-20 16:10:52 +02:00
memstick
message
mfd mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set 2021-09-22 12:26:44 +02:00
misc cb710: avoid NULL pointer subtraction 2021-10-20 11:40:13 +02:00
mmc mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk 2021-10-13 10:08:16 +02:00
mtd mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' 2021-09-22 12:26:45 +02:00
mux
net can: peak_pci: peak_pci_remove(): fix UAF 2021-10-27 09:54:26 +02:00
nfc nfc: nfcsim: fix use after free during module unload 2021-08-04 12:27:38 +02:00
ntb NTB: perf: Fix an error code in perf_setup_inbuf() 2021-09-22 12:26:44 +02:00
nubus
nvdimm libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind 2021-10-06 15:42:38 +02:00
nvme nvme-multipath: fix ANA state updates when a namespace is not present 2021-09-30 10:09:25 +02:00
nvmem nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells 2021-10-20 11:40:14 +02:00
of of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS 2021-09-22 12:26:34 +02:00
opp opp: Don't print an error if required-opps is missing 2021-09-22 12:26:33 +02:00
oprofile
parisc parisc: Move pci_dev_is_behind_card_dino to where it is used 2021-09-26 14:07:10 +02:00
parport parport: remove non-zero check on count 2021-09-22 12:26:36 +02:00
pci PCI: Fix pci_host_bridge struct device release/free handling 2021-10-06 15:42:38 +02:00
pcmcia pcmcia: i82092: fix a null pointer dereference bug 2021-08-12 13:21:03 +02:00
perf
phy phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() 2021-07-14 16:53:46 +02:00
pinctrl pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() 2021-09-22 12:26:24 +02:00
platform platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call 2021-10-20 11:40:17 +02:00
pnp
power power: supply: max17042: handle fails of reading status register 2021-09-22 12:26:21 +02:00
powercap
pps
ps3
ptp ptp_pch: Load module automatically if ID matches 2021-10-13 10:08:19 +02:00
pwm pwm: stm32-lp: Don't modify HW state in .remove() callback 2021-09-26 14:07:13 +02:00
rapidio
ras
regulator regulator: vctrl: Avoid lockdep warning in enable/disable ops 2021-09-15 09:47:29 +02:00
remoteproc
reset reset: reset-zynqmp: Fixed the argument data type 2021-09-12 08:56:39 +02:00
rpmsg
rtc rtc: rx8010: select REGMAP_I2C 2021-09-26 14:07:14 +02:00
s390 s390/sclp: fix Secure-IPL facility detection 2021-09-22 12:26:40 +02:00
sbus
scsi scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 2021-10-17 10:42:34 +02:00
sfi
sh
siox
slimbus slimbus: ngd: reset dma setup during runtime pm 2021-08-26 08:36:21 -04:00
soc soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment 2021-10-13 10:08:18 +02:00
soundwire soundwire: stream: Fix test for DP prepare complete 2021-07-14 16:53:45 +02:00
spi spi: Fix tegra20 build with CONFIG_PM=n 2021-09-30 10:09:26 +02:00
spmi
ssb ssb: Fix error return code in ssb_bus_scan() 2021-07-14 16:53:29 +02:00
staging staging: greybus: uart: fix tty use after free 2021-09-30 10:09:21 +02:00
target scsi: target: avoid per-loop XCOPY buffer allocations 2021-09-22 12:26:25 +02:00
tc
tee tee: optee: Fix missing devices unregister during optee_remove 2021-10-27 09:54:25 +02:00
thermal thermal/drivers/int340x: Do not set a wrong tcc offset on resume 2021-09-30 10:09:26 +02:00
thunderbolt
tty tty: Fix out-of-bound vmalloc access in imageblit 2021-10-06 15:42:29 +02:00
uio
usb USB: serial: option: add prod. id for Quectel EG91 2021-10-20 11:40:14 +02:00
vfio vfio: Use config not menuconfig for VFIO_NOIOMMU 2021-09-22 12:26:23 +02:00
vhost vhost_net: fix OoB on sendmsg() failure. 2021-09-22 12:26:41 +02:00
video video: fbdev: gbefb: Only instantiate device when built for IP32 2021-10-13 10:08:19 +02:00
virt
virtio virtio: write back F_VERSION_1 before validate 2021-10-20 11:40:14 +02:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-07-14 16:53:42 +02:00
vlynq
vme
w1 w1: ds2438: fixing bug that would always get page0 2021-07-20 16:10:41 +02:00
watchdog watchdog: orion: use 0 for unset heartbeat 2021-10-20 11:40:13 +02:00
xen xen/balloon: fix cancelled balloon action 2021-10-13 10:08:17 +02:00
zorro
Kconfig
Makefile