No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Zhou Qingyang a821532ce5 media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
[ Upstream commit 348df8035301dd212e3cc2860efe4c86cb0d3303 ]

In hexium_attach(dev, info), saa7146_vv_init() is called to allocate
a new memory for dev->vv_data. In hexium_detach(), saa7146_vv_release()
will be called and there is a dereference of dev->vv_data in
saa7146_vv_release(), which could lead to a NULL pointer dereference
on failure of saa7146_vv_init() according to the following logic.

Both hexium_attach() and hexium_detach() are callback functions of
the variable 'extension', so there exists a possible call chain directly
from hexium_attach() to hexium_detach():

hexium_attach(dev, info) -- fail to alloc memory to dev->vv_data
	|		    		in saa7146_vv_init().
	|
	|
hexium_detach() -- a dereference of dev->vv_data in saa7146_vv_release()

Fix this bug by adding a check of saa7146_vv_init().

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_VIDEO_HEXIUM_ORION=m show no new warnings,
and our static analyzer no longer warns about this code.

Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 09:19:42 +01:00
arch x86/mm: Flush global TLB when switching to trampoline page-table 2022-01-27 09:19:42 +01:00
block block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) 2021-12-14 14:49:02 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: pcrypt - Delay write to padata->info 2021-11-17 09:48:40 +01:00
Documentation Input: i8042 - add deferred probe support 2022-01-05 12:37:43 +01:00
drivers media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() 2022-01-27 09:19:42 +01:00
fs fs: dlm: filter user dlm messages for kernel locks 2022-01-27 09:19:40 +01:00
include mm_zone: add function to check if managed dma zone exists 2022-01-27 09:19:28 +01:00
init
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel rcu/exp: Mark current CPU as exp-QS in IPI loop second pass 2022-01-27 09:19:33 +01:00
lib siphash: use _unaligned version by default 2021-12-08 09:01:12 +01:00
LICENSES
mm shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode 2022-01-27 09:19:29 +01:00
net batman-adv: allow netlink usage in unprivileged containers 2022-01-27 09:19:41 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts recordmcount.pl: fix typo in s390 mcount regex 2022-01-05 12:37:44 +01:00
security selinux: fix potential memleak in selinux_add_opt() 2022-01-27 09:19:35 +01:00
sound ASoC: samsung: idma: Check of ioremap return value 2022-01-27 09:19:39 +01:00
tools bpftool: Enable line buffering for stdout 2022-01-27 09:19:35 +01:00
usr
virt KVM: do not shrink halt_poll_ns below grow_start 2021-10-09 14:39:50 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.173 2022-01-20 09:19:19 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.