kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Guoqing Jiang bc3889a39b media: mtk-jpeg: Fix null-ptr-deref during unload module 
commit 17af2b39da upstream.

The workqueue should be destroyed in mtk_jpeg_core.c since commit
09aea13ecf ("media: mtk-jpeg: refactor some variables"), otherwise
the below calltrace can be easily triggered.

[  677.862514] Unable to handle kernel paging request at virtual address dfff800000000023
[  677.863633] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
...
[  677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G           O       6.8.12-mtk+gfa1a78e5d24b+ #17
...
[  677.882838] pc : destroy_workqueue+0x3c/0x770
[  677.883413] lr : mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
[  677.884314] sp : ffff80008ad974f0
[  677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070
[  677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690
[  677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff800000000000
[  677.887515] x20: 0000000000000000 x19: 0000000000000000 x18: ffff800085397ac0
[  677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1ffff000115b2e10
[  677.889361] x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff7000115b2e4d
[  677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90
[  677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : 0000000000000001
[  677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : 0000000000000000
[  677.893054] x2 : 0000000000000023 x1 : dfff800000000000 x0 : 0000000000000118
[  677.893977] Call trace:
[  677.894297]  destroy_workqueue+0x3c/0x770
[  677.894826]  mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
[  677.895677]  devm_action_release+0x50/0x90
[  677.896211]  release_nodes+0xe8/0x170
[  677.896688]  devres_release_all+0xf8/0x178
[  677.897219]  device_unbind_cleanup+0x24/0x170
[  677.897785]  device_release_driver_internal+0x35c/0x480
[  677.898461]  device_release_driver+0x20/0x38
...
[  677.912665] ---[ end trace 0000000000000000 ]---

Fixes: 09aea13ecf ("media: mtk-jpeg: refactor some variables")
Cc: <stable@vger.kernel.org>
Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-12-09 10:40:58 +01:00
..
accel accel/ivpu: Prevent recovery invocation during probe and resume 2024-12-05 14:01:44 +01:00
accessibility treewide: remove unnecessary <linux/version.h> inclusion 2024-08-12 18:36:44 +09:00
acpi ACPI: CPPC: Fix _CPC register setting issue 2024-12-05 14:01:20 +01:00
amba ARM: 9416/1: amba: make amba_bustype constant 2024-09-04 15:01:17 +01:00
android binder: modify the comment for binder_proc_unlock 2024-09-11 16:02:45 +02:00
ata ata: libata: Set DID_TIME_OUT for commands that actually timed out 2024-10-24 11:14:00 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-12 10:41:44 +01:00
auxdisplay move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
base firmware_loader: Fix possible resource leak in fw_log_firmware_info() 2024-12-05 14:02:38 +01:00
bcma PCI: Rename CRS Completion Status to RRS 2024-09-10 19:52:30 -05:00
block brd: decrease the number of allocated pages which discarded 2024-12-05 14:03:10 +01:00
bluetooth Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() 2024-12-05 14:01:59 +01:00
bus bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian 2024-12-05 14:02:38 +01:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-10-17 19:47:15 -06:00
cdx cdx: remove unused struct 'cdx_mcdi_copy_buffer' 2024-07-31 13:56:50 +02:00
char tpm: Disable TPM on tpm2_create_primary() failure 2024-11-13 21:10:45 +02:00
clk clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access 2024-12-05 14:02:45 +01:00
clocksource clocksource/drivers/timer-ti-dm: Fix child node refcount handling 2024-12-05 14:01:23 +01:00
comedi comedi: Flush partial mappings in error case 2024-12-05 14:02:46 +01:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter counter: stm32-timer-cnt: fix device_node handling in probe_encoder() 2024-12-05 14:03:01 +01:00
cpufreq cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() 2024-12-05 14:02:51 +01:00
cpuidle pmdomain core: 2024-09-18 10:49:45 +02:00
crypto crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() 2024-12-05 14:01:21 +01:00
cxl cxl/port: Prevent out-of-order decoder allocation 2024-10-25 16:07:03 -05:00
dax dax: delete a stale directory pmem 2024-12-05 14:02:13 +01:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: imx-bus: Use of_property_present() 2024-09-05 01:23:56 +09:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma dmaengine fixes for v6.12 2024-11-03 10:15:50 -10:00
dma-buf udmabuf: fix vmap_udmabuf error page set 2024-12-05 14:01:38 +01:00
dpll dpll: add Embedded SYNC feature for a pin 2024-08-26 19:21:14 -07:00
edac EDAC/igen6: Avoid segmentation fault on module unload 2024-12-05 14:01:18 +01:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
firewire firewire: core: fix invalid port index for parent device 2024-10-27 11:14:35 +09:00
firmware firmware: arm_scpi: Check the DVFS OPP count returned by the firmware 2024-12-05 14:01:34 +01:00
fpga move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
fsi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio gpio: exar: set value when external pull-up or pull-down is present 2024-12-05 14:02:51 +01:00
gpu drm/xe/ufence: Wake up waiters after setting ufence->signalled 2024-12-05 14:02:39 +01:00
greybus move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hid HID: wacom: Interpret tilt data from Intuos Pro BT as signed values 2024-12-05 14:02:56 +01:00
hsi HSI: omap-ssi: Remove unnecessary debugfs_create_dir() error check 2024-08-27 15:28:56 +02:00
hte hte: tegra-194: add missing MODULE_DESCRIPTION() macro 2024-06-19 12:24:03 -07:00
hv drm next for 6.12-rc1 2024-09-19 10:18:15 +02:00
hwmon hwmon: (aquacomputer_d5next) Fix length of speed_input array 2024-12-05 14:02:27 +01:00
hwspinlock hwspinlock: qcom: implement bust operation 2024-05-29 12:52:26 -07:00
hwtracing [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
i2c i2c: dev: Fix memory leak when underlying adapter does not support I2C 2024-12-05 14:01:58 +01:00
i3c i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin 2024-12-05 14:02:22 +01:00
idle intel_idle: fix ACPI _CST matching for newer Xeon platforms 2024-09-25 22:30:33 +02:00
iio iio: gts: Fix uninitialized symbol 'ret' 2024-12-05 14:02:55 +01:00
infiniband RDMA/bnxt_re: Correct the sequence of device suspend 2024-12-05 14:02:16 +01:00
input Input: cs40l50 - fix wrong usage of INIT_WORK() 2024-12-05 14:03:02 +01:00
interconnect interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency 2024-12-05 14:02:37 +01:00
iommu iommu/tegra241-cmdqv: Fix unused variable warning 2024-12-09 10:40:56 +01:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain 2024-12-05 14:02:53 +01:00
isdn move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
leds leds: ktd2692: Set missing timing properties 2024-12-05 14:02:10 +01:00
macintosh move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mailbox kfifo: don't include dma-mapping.h in kfifo.h 2024-12-05 14:03:03 +01:00
mcb Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
md md/md-bitmap: Add missing destroy_work_on_stack() 2024-12-09 10:40:56 +01:00
media media: mtk-jpeg: Fix null-ptr-deref during unload module 2024-12-09 10:40:58 +01:00
memory memory: pl353-smc: simplify with scoped for each OF child loop 2024-08-31 07:44:24 +02:00
memstick move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-05 14:02:10 +01:00
mfd mfd: rt5033: Fix missing regmap_del_irq_chip() 2024-12-05 14:02:10 +01:00
misc Compiler Attributes: disable __counted_by for clang < 19.1.3 2024-12-05 14:02:45 +01:00
mmc mmc: mmc_spi: drop buggy snprintf() 2024-12-05 14:01:26 +01:00
most Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
mtd ubi: fastmap: Fix duplicate slab cache names while attaching 2024-12-05 14:03:04 +01:00
mux mux: remove usage of the deprecated ida_simple_xx() API 2024-04-29 08:20:07 -07:00
net netkit: Add option for scrubbing skb meta data 2024-12-09 10:40:56 +01:00
nfc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ntb ntb: Force physically contiguous allocation of rx ring buffers 2024-09-20 10:51:25 -04:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm virtio: features, fixes, cleanups 2024-09-26 08:43:17 -07:00
nvme nvme-fabrics: fix kernel crash while shutting down controller 2024-12-05 14:03:06 +01:00
nvmem Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
of of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify 2024-12-05 14:01:32 +01:00
opp OPP: fix error code in dev_pm_opp_set_config() 2024-10-02 01:27:50 +02:00
parisc parisc: pdc_stable: Constify struct kobj_type 2024-09-09 08:53:17 +02:00
parport parport: Proper fix for array out-of-bounds access 2024-10-13 18:17:35 +02:00
pci PCI: Fix use-after-free of slot->bus on hot remove 2024-12-05 14:02:45 +01:00
pcmcia move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
peci move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
perf perf/arm-cmn: Ensure port and device id bits are set properly 2024-12-05 14:03:06 +01:00
phy phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe 2024-12-05 14:02:38 +01:00
pinctrl pinctrl: qcom: spmi: fix debugfs drive strength 2024-12-05 14:02:47 +01:00
platform platform/chrome: cros_ec_typec: fix missing fwnode reference decrement 2024-12-05 14:02:52 +01:00
pmdomain pmdomain: ti-sci: Add missing of_node_put() for args.np 2024-12-05 14:01:32 +01:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power power: reset: ep93xx: add AUXILIARY_BUS dependency 2024-12-05 14:02:30 +01:00
powercap powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() 2024-10-21 13:23:06 +02:00
pps [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
pwm pwm: Assume a disabled PWM to emit a constant inactive output 2024-12-05 14:01:34 +01:00
rapidio driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
ras RAS/AMD/ATL: Translate normalized to system physical addresses using PRM 2024-08-01 14:36:29 +02:00
regulator regulator: rk808: Restrict DVS GPIOs to the RK808 variant only 2024-12-05 14:01:29 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region 2024-12-05 14:02:26 +01:00
reset reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC 2024-09-30 14:24:37 +02:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-05 14:02:25 +01:00
rtc rtc: ab-eoz9: don't fail temperature reads on undervoltage notification 2024-12-05 14:03:07 +01:00
s390 s390/cio: Do not unregister the subchannel based on DNV 2024-12-05 14:01:11 +01:00
sbus [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
scsi scsi: sg: Enable runtime power management 2024-12-05 14:02:11 +01:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-05 14:03:10 +01:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus slimbus: qcom-ngd-ctrl: use 'time_left' variable with wait_for_completion_timeout() 2024-09-03 12:10:38 +02:00
soc soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() 2024-12-05 14:02:57 +01:00
soundwire soundwire: intel_ace2x: Send PDI stream number during prepare 2024-10-17 12:11:19 +01:00
spi spi: Fix acpi deferred irq probe 2024-12-05 14:02:51 +01:00
spmi spmi: pmic-arb: add missing newline in dev_err format strings 2024-07-31 13:49:28 +02:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node 2024-12-05 14:03:01 +01:00
target scsi: target: Fix incorrect function name in pscsi_create_type_disk() 2024-12-05 14:02:10 +01:00
tc driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
tee optee: Fix a NULL vs IS_ERR() check 2024-09-09 12:22:06 +02:00
thermal thermal: testing: Initialize some variables annoteded with _free() 2024-12-05 14:01:20 +01:00
thunderbolt thunderbolt: Fixes for v6.12-rc7 2024-11-07 16:11:57 +01:00
tty serial: amba-pl011: fix build regression 2024-12-05 14:02:54 +01:00
ufs SCSI fixes on 20241108 2024-11-08 09:56:27 -10:00
uio uio: Constify struct kobj_type 2024-09-11 16:02:54 +02:00
usb usb: dwc3: gadget: Fix looping of queued SG entries 2024-12-05 14:03:01 +01:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-05 14:02:28 +01:00
vfio vfio/pci: Properly hide first-in-list PCIe extended capability 2024-12-05 14:02:29 +01:00
vhost virtio: bugfixes 2024-10-07 11:33:26 -07:00
video fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-12-05 14:02:14 +01:00
virt [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
virtio virtio_pci: Fix admin vq cleanup by using correct info pointer 2024-11-06 04:40:07 -05:00
w1 w1: ds2482: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-06 19:18:32 +02:00
watchdog watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240 2024-12-05 14:01:31 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-05 14:02:40 +01:00
zorro Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00