Zhou Qingyang
15115464eb
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() ...
[ Upstream commit ab50cb9df8896b39aae65c537a30de2c79c19735 ]
In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to
vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In
radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va,
which could lead to a NULL pointer dereference on failure of
radeon_vm_bo_add().
Fix this bug by adding a check of vm->ib_bo_va.
This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.
Builds with CONFIG_DRM_RADEON=m show no new warnings,
and our static analyzer no longer warns about this code.
Fixes: cc9e67e3d7
2022-01-27 09:19:32 +01:00
ACPI: EC: Rework flushing of EC work while suspended to idle
2022-01-27 09:19:32 +01:00
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-06 13:59:45 +01:00
binder: fix async_free_space accounting for empty parcels
2022-01-05 12:37:46 +01:00
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
2021-12-22 09:29:39 +01:00
auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-17 09:48:45 +01:00
devtmpfs regression fix: reconfigure on each mount
2022-01-20 09:19:17 +01:00
bcma: Fix memory leak for internally-handled cores
2021-09-15 09:47:37 +02:00
xen/blkfront: harden blkfront against event channel storms
2021-12-22 09:29:40 +01:00
Bluetooth: bfusb: fix division by zero in send path
2022-01-16 09:15:38 +01:00
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
2021-10-13 10:08:19 +02:00
random: fix crash on multiple early calls to add_bootloader_randomness()
2022-01-16 09:15:39 +01:00
clk: bcm-2835: Remove rounding up the dividers
2022-01-27 09:19:29 +01:00
clocksource/drivers/timer-ti-dm: Select TIMER_OF
2021-11-17 09:48:39 +01:00
counter: 104-quad-8: Return error when invalid mode during ceiling_write
2021-09-15 09:47:34 +02:00
cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
2021-12-08 09:01:11 +01:00
cpuidle: Fix kobject memory leaks in error paths
2021-11-17 09:48:36 +01:00
crypto: qce - fix uaf on qce_ahash_register_one
2022-01-27 09:19:30 +01:00
dmaengine: st_fdma: fix MODULE_ALIAS
2021-12-22 09:29:36 +01:00
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
2022-01-27 09:19:28 +01:00
EDAC/amd64: Handle three rank interleaving mode
2021-11-17 09:48:36 +01:00
firmware: qemu_fw_cfg: fix kobject leak in probe error path
2022-01-20 09:19:18 +01:00
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
2021-09-30 10:09:23 +02:00
gpio: pca953x: Improve bias setting
2021-10-20 11:40:15 +02:00
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
2022-01-27 09:19:32 +01:00
HID: wacom: Avoid using stale array indicies to read contact count
2022-01-27 09:19:26 +01:00
hyperv/vmbus: include linux/bitops.h
2021-11-17 09:48:20 +01:00
hwmon: (lm90) Do not report 'busy' status bit as alarm
2021-12-29 12:23:37 +01:00
intel_th: Wait until port is in reset before programming it
2021-07-20 16:10:46 +02:00
i2c: validate user data in compat ioctl
2022-01-05 12:37:45 +01:00
iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
2021-12-22 09:29:35 +01:00
RDMA/uverbs: Check for null return of kmalloc_array
2022-01-11 15:23:31 +01:00
Input: touchscreen - Fix backport of a02dcde595f7cbd240ccd64de96034ad91cffc40
2022-01-11 15:23:30 +01:00
iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
2022-01-27 09:19:28 +01:00
ipack: ipoctal: fix module reference leak
2021-10-06 15:42:36 +02:00
irqchip: nvic: Fix offset for Interrupt Priority Offsets
2021-12-14 14:49:06 +01:00
mISDN: change function names to avoid conflicts
2022-01-11 15:23:33 +01:00
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
2021-09-15 09:47:33 +02:00
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:09:22 +02:00
dm btree remove: fix use after free in rebalance_children()
2021-12-22 09:29:35 +01:00
media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
2022-01-27 09:19:31 +01:00
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
2021-11-17 09:48:42 +01:00
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-17 09:48:37 +01:00
mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
2022-01-16 09:15:38 +01:00
lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
2022-01-27 09:19:28 +01:00
mmc: sdhci-pci: Add PCI ID for Intel ADL
2022-01-16 09:15:38 +01:00
mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
2022-01-27 09:19:26 +01:00
wcn36xx: Release DMA channel descriptor allocations
2022-01-27 09:19:29 +01:00
NFC: st21nfca: Fix memory leak in device probe and remove
2022-01-05 12:37:44 +01:00
NTB: perf: Fix an error code in perf_setup_inbuf()
2021-09-22 12:26:44 +02:00
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
2021-10-06 15:42:38 +02:00
nvmet: use IOCB_NOWAIT only if the filesystem supports it
2021-12-01 09:23:33 +01:00
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-20 11:40:14 +02:00
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
2021-09-22 12:26:34 +02:00
opp: Fix return in _opp_add_static_v2()
2021-11-17 09:48:44 +01:00
parisc: Move pci_dev_is_behind_card_dino to where it is used
2021-09-26 14:07:10 +02:00
parport: remove non-zero check on count
2021-09-22 12:26:36 +02:00
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
2022-01-27 09:19:28 +01:00
pcmcia: i82092: fix a null pointer dereference bug
2021-08-12 13:21:03 +02:00
phy: qcom-qusb2: Fix a memory leak on probe
2021-11-17 09:48:43 +01:00
pinctrl: mediatek: fix global-out-of-bounds issue
2021-12-29 12:23:37 +01:00
platform/x86: apple-gmux: use resource_size() with res
2022-01-05 12:37:43 +01:00
power: reset: ltc2952: Fix use of floating point literals
2022-01-11 15:23:32 +01:00
ptp_pch: Load module automatically if ID matches
2021-10-13 10:08:19 +02:00
pwm: stm32-lp: Don't modify HW state in .remove() callback
2021-09-26 14:07:13 +02:00
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
2021-11-17 09:48:22 +01:00
reset: socfpga: add empty driver allowing consumers to probe
2021-11-17 09:48:20 +01:00
rtc: cmos: take rtc_lock while reading from CMOS
2022-01-27 09:19:27 +01:00
s390/cio: make ccw_device_dma_* more robust
2021-11-17 09:48:50 +01:00
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
2022-01-11 15:23:33 +01:00
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:47:17 +01:00
slimbus: ngd: reset dma setup during runtime pm
2021-08-26 08:36:21 -04:00
soc/tegra: fuse: Fix bitwise vs. logical OR warning
2021-12-22 09:29:37 +01:00
spi: change clk_disable_unprepare to clk_unprepare
2021-12-29 12:23:34 +01:00
staging: greybus: fix stack size warning with UBSAN
2022-01-16 09:15:39 +01:00
scsi: target: Fix alua_tg_pt_gps_count tracking
2021-11-26 10:47:16 +01:00
tee: fix put order in teedev_close_context()
2022-01-27 09:19:30 +01:00
thermal: core: Reset previous low and high trip during thermal zone init
2021-12-08 09:01:09 +01:00
tty: serial: atmel: Call dma_async_issue_pending()
2022-01-27 09:19:31 +01:00
USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
2022-01-16 09:15:38 +01:00
vfio: Use config not menuconfig for VFIO_NOIOMMU
2021-09-22 12:26:23 +02:00
vhost/vsock: fix incorrect used length reported to the guest
2021-12-01 09:23:34 +01:00
vgacon: Propagate console boot parameters before calling `vc_resize'
2021-12-08 09:01:13 +01:00
virtio_ring: Fix querying of maximum DMA mapping size for virtio device
2021-12-22 09:29:34 +01:00
w1: ds2438: fixing bug that would always get page0
2021-07-20 16:10:41 +02:00
ar7: fix kernel builds for compiler test
2021-11-17 09:48:46 +01:00
xen: detect uninitialized xenbus in xenbus_init
2021-12-01 09:23:28 +01:00
15115464eb