kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/misc
History
Jorgen Hansen 1fa1940f02 VMCI: Resource wildcard match fixed 
commit 11924ba5e6 upstream.

When adding a VMCI resource, the check for an existing entry
would ignore that the new entry could be a wildcard. This could
result in multiple resource entries that would match a given
handle. One disastrous outcome of this is that the
refcounting used to ensure that delayed callbacks for VMCI
datagrams have run before the datagram is destroyed can be
wrong, since the refcount could be increased on the duplicate
entry. This in turn leads to a use after free bug. This issue
was discovered by Hangbin Liu using KASAN and syzkaller.

Fixes: bc63dedb7d ("VMCI: resource object implementation")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Adit Ranadive <aditr@vmware.com>
Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: Drop the version change.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-02-11 17:53:25 +00:00
..
altera-stapl Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2011-10-31 15:42:54 -07:00
c2port c2port: convert class code to use bin_attrs in groups 2013-07-24 15:39:05 -07:00
carma drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
cb710 mmc: cb710: drop free_irq for devm_request_irq allocated irq 2013-09-26 13:55:30 -07:00
echo staging: echo: move to drivers/misc/ 2014-02-28 14:08:42 -08:00
eeprom eeprom: at24: check at24_read/write arguments 2018-03-03 15:51:38 +00:00
genwqe signal/GenWQE: Fix sending of SIGKILL 2019-02-11 17:53:18 +00:00
ibmasm ibmasm: don't write out of bounds in read handler 2018-11-20 18:05:38 +00:00
lis3lv02d drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
mei mei: bus: type promotion bug in mei_nfc_if_version() 2018-12-16 22:08:14 +00:00
mic misc: mic: Fix for double fetch security bug in VOP driver 2016-08-22 22:38:29 +01:00
sgi-gru Merge branch 'x86-uv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next 2014-06-03 15:48:23 -07:00
sgi-xp mm: fix GFP_THISNODE callers and clarify 2014-03-10 17:26:19 -07:00
ti-st drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
vmw_vmci VMCI: Resource wildcard match fixed 2019-02-11 17:53:25 +00:00
ad525x_dpot-i2c.c misc: remove use of __devexit 2012-11-21 12:53:32 -08:00
ad525x_dpot-spi.c misc: remove use of __devexit 2012-11-21 12:53:32 -08:00
ad525x_dpot.c misc: ad525x_dpot: Fix the enabling of the "otpXen" attributes 2017-10-12 15:28:17 +01:00
ad525x_dpot.h Merge branch 'char-misc-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 2012-01-09 12:08:59 -08:00
apds990x.c misc: replace strict_strtoul() with kstrtoul() 2013-06-06 12:54:08 -07:00
apds9802als.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
arm-charlcd.c misc: arm-charlcd: add DT probe support 2014-05-03 19:26:25 -04:00
atmel-ssc.c ASoC: atmel_ssc_dai: make option to choose clock 2014-02-12 17:21:22 +00:00
atmel_pwm.c misc: atmel_pwm: add deferred-probing support 2013-10-29 16:22:57 -07:00
atmel_tclib.c ARM: at91/tc/clocksource: Add 32 bit variant to Timer Counter 2012-03-01 13:38:49 +01:00
bh1770glc.c misc: replace strict_strtoul() with kstrtoul() 2013-06-06 12:54:08 -07:00
bh1780gli.c misc: bh1780: probe from compatible string 2013-10-03 16:02:35 -07:00
bmp085-i2c.c misc: bmp085: Clean up and enable use of interrupt for completion. 2013-12-04 20:23:51 -08:00
bmp085-spi.c misc: bmp085: Clean up and enable use of interrupt for completion. 2013-12-04 20:23:51 -08:00
bmp085.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
bmp085.h misc: bmp085: Clean up and enable use of interrupt for completion. 2013-12-04 20:23:51 -08:00
cs5535-mfgpt.c cs5535-mfgpt: Fix quotation marks 2013-04-03 11:23:13 -07:00
ds1682.c misc: (ds1682) replace obsolete simple_strtoull() with kstrtoull() 2014-05-03 19:26:24 -04:00
dummy-irq.c treewide: Fix typo in printk 2013-05-28 12:02:13 +02:00
enclosure.c scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails. 2017-10-12 15:27:58 +01:00
fsa9480.c treewide: fix comments and printk msgs 2014-01-07 15:06:07 +01:00
hmc6352.c misc: hmc6352: fix potential Spectre v1 2018-12-16 22:09:16 +00:00
hpilo.c drivers/misc/hpilo: Correct panic when an AUX iLO is detected 2013-08-14 14:46:22 -07:00
hpilo.h misc: hpilo: increase number of max supported channels 2012-06-14 17:22:12 -07:00
ics932s401.c hwmon: Change my email address. 2013-08-27 08:28:01 -07:00
ioc4.c misc: remove use of __devexit 2012-11-21 12:53:32 -08:00
isl29003.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
isl29020.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
Kconfig misc/bmp085: Enable building as a module 2016-05-01 00:05:47 +02:00
kgdbts.c kgdb/kgdbts: support ppc64 2013-03-02 08:52:17 -06:00
lattice-ecp3-config.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
lkdtm.c lkdtm: fix handle_irq_event symbol for INT_HW_IRQ_EN 2018-06-16 22:22:00 +01:00
Makefile mfd: vexpress: Define the device as MFD cells 2014-05-15 17:02:19 +01:00
pch_phub.c pch_phub: Report error writing MAC back to user 2014-03-08 22:15:51 -08:00
phantom.c misc: phantom: remove deprecated IRQF_DISABLED 2013-10-16 12:36:10 -07:00
pti.c misc: pti: remove unnecessary pci_set_drvdata() 2013-09-26 09:13:54 -07:00
spear13xx_pcie_gadget.c misc: replace strict_strtoul() with kstrtoul() 2013-06-06 12:54:08 -07:00
sram.c misc: sram: implement reserved sram areas 2014-02-28 15:31:11 -08:00
ti_dac7512.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
tifm_7xx1.c tifm: fix error return code in tifm_7xx1_probe() 2013-10-30 10:19:30 -07:00
tifm_core.c tifm: convert bus code to use dev_groups 2013-10-16 18:40:58 -07:00
tsl2550.c drivers/misc: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
vexpress-syscfg.c misc: vexpress: fix error handling vexpress_syscfg_regmap_init() 2014-06-17 17:09:40 +02:00
vmw_balloon.c MAINTAINERS: add entry for VMware Balloon driver 2014-06-20 11:47:33 -07:00