No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Zhipeng Lu f20c3270f3 media: edia: dvbdev: fix a use-after-free
[ Upstream commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 ]

In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
in several error-handling paths. However, *pdvbdev is not set to NULL
after dvbdev's deallocation, causing use-after-frees in many places,
for example, in the following call chain:

budget_register
  |-> dvb_dmxdev_init
        |-> dvb_register_device
  |-> dvb_dmxdev_release
        |-> dvb_unregister_device
              |-> dvb_remove_device
                    |-> dvb_device_put
                          |-> kref_put

When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
dvb_register_device) could point to memory that had been freed in
dvb_register_device. Thereafter, this pointer is transferred to
kref_put and triggering a use-after-free.

Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.edu.cn
Fixes: b619010247 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-03-26 18:22:19 -04:00
arch x86, relocs: Ignore relocations in .notes section 2024-03-26 18:22:16 -04:00
block block: sed-opal: handle empty atoms when parsing response 2024-03-26 18:22:12 -04:00
certs
crypto crypto: api - Disallow identical driver names 2024-02-23 08:24:48 +01:00
Documentation net: sysfs: Fix /sys/class/net/<iface> path 2024-02-23 08:25:05 +01:00
drivers media: edia: dvbdev: fix a use-after-free 2024-03-26 18:22:19 -04:00
fs fs/select: rework stack allocation hack for clang 2024-03-26 18:22:13 -04:00
include drm: Don't treat 0 as -1 in drm_fixp2int_ceil 2024-03-26 18:22:19 -04:00
init rootfs: Fix support for rootfstype= when root= is given 2024-01-25 14:34:30 -08:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:23:06 +01:00
kernel bpf: Fix stackmap overflow check on 32-bit arches 2024-03-26 18:22:17 -04:00
lib net: blackhole_dev: fix build warning for ethh set but not used 2024-03-26 18:22:15 -04:00
LICENSES
mm userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb 2024-03-01 13:13:33 +01:00
net net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:22:18 -04:00
samples samples/bpf: Fix buffer overflow in tcp_basertt 2023-07-27 08:37:07 +02:00
scripts scripts/bpf: Fix xdp_md forward declaration typo 2024-03-01 13:13:38 +01:00
security lsm: new security_file_ioctl_compat() hook 2024-02-23 08:25:15 +01:00
sound ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll 2024-03-26 18:22:13 -04:00
tools perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() 2024-03-26 18:22:19 -04:00
usr
virt KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler 2024-03-01 13:13:32 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.272 2024-03-15 14:40:56 -04:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.