kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Joe Hattori e9d07e91de memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() 
[ Upstream commit b9784e5cde ]

As of_find_node_by_name() release the reference of the argument device
node, tegra_emc_find_node_by_ram_code() releases some device nodes while
still in use, resulting in possible UAFs. According to the bindings and
the in-tree DTS files, the "emc-tables" node is always device's child
node with the property "nvidia,use-ram-code", and the "lpddr2" node is a
child of the "emc-tables" node. Thus utilize the
for_each_child_of_node() macro and of_get_child_by_name() instead of
of_find_node_by_name() to simplify the code.

This bug was found by an experimental verification tool that I am
developing.

Fixes: 96e5da7c84 ("memory: tegra: Introduce Tegra20 EMC driver")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp
Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp
[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-02-21 13:49:12 +01:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:02:55 +02:00
acpi ACPI: fan: cleanup resources in the error path of .probe() 2025-02-21 13:49:00 +01:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:10:26 +02:00
ata ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() 2024-12-19 18:08:48 +01:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:30:24 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:49:51 +02:00
base regmap: detach regmap from dev on regmap_exit 2025-02-01 18:30:06 +01:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block nbd: don't allow reconnect after disconnect 2025-02-21 13:48:53 +01:00
bluetooth Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables 2024-12-14 19:54:44 +01:00
bus bus: mhi: host: pci_generic: Fix the name for the Telit FE990A 2024-10-17 15:21:20 +02:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:47:10 +02:00
char ipmi: ipmb: Add check devm_kasprintf() returned value 2025-02-21 13:48:57 +01:00
clk clk: analogbits: Fix incorrect calculation of vco rate delta 2025-02-21 13:49:05 +01:00
clocksource x86/hyperv: Fix hv tsc page based sched_clock for hibernation 2025-01-09 13:29:56 +01:00
comedi comedi: Flush partial mappings in error case 2024-12-14 19:53:59 +01:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: ti-ecap-capture: Add check for clk_enable() 2024-12-14 19:53:53 +01:00
cpufreq cpufreq: ACPI: Fix max-frequency computation 2025-02-21 13:49:04 +01:00
cpuidle cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu 2025-01-17 13:34:41 +01:00
crypto crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() 2025-02-21 13:49:08 +01:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:52:53 +01:00
dax dax: delete a stale directory pmem 2024-12-14 19:53:41 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:12:47 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset 2025-01-02 10:30:50 +01:00
dma-buf udmabuf: also check for F_SEAL_FUTURE_WRITE 2024-12-27 13:53:01 +01:00
edac EDAC/igen6: Avoid segmentation fault on module unload 2024-12-14 19:53:17 +01:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:03:41 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:56:16 +02:00
firmware arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-12-14 19:54:53 +01:00
fpga fpga: manager: add owner module and take its refcount 2024-12-14 19:53:12 +01:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpiolib: cdev: Fix use after free in lineinfo_changed_notify 2025-01-23 17:17:14 +01:00
gpu drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE 2025-02-21 13:48:57 +01:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:36:00 +02:00
hid HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check 2025-02-21 13:49:02 +01:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2022-12-31 13:32:45 +01:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet 2024-12-27 13:52:59 +01:00
hwmon hwmon: (tmp513) Fix division of negative numbers 2025-01-23 17:17:10 +01:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:53:09 +02:00
hwtracing coresight: tmc: sg: Do not leak sg_table 2024-10-17 15:21:11 +02:00
i2c i2c: rcar: fix NACK handling when being a target 2025-01-23 17:17:11 +01:00
i3c i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition 2024-12-14 19:54:56 +01:00
idle intel_idle: add Emerald Rapids Xeon support 2023-10-10 22:00:44 +02:00
iio iio: adc: rockchip_saradc: fix information leak in triggered buffer 2025-01-23 17:17:16 +01:00
infiniband RDMA/srp: Fix error handling in srp_add_port 2025-02-21 13:49:12 +01:00
input Input: xpad - add support for wooting two he (arm) 2025-02-01 18:30:11 +01:00
interconnect interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID 2024-08-03 08:49:19 +02:00
iommu iommu/arm-smmu: Defer probe of clients after smmu device bound 2024-12-14 19:54:37 +01:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip/sunxi-nmi: Add missing SKIP_WAKE flag 2025-02-01 18:30:06 +01:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-03 08:49:50 +02:00
leds leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata() 2025-02-21 13:49:00 +01:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:49:22 +02:00
mailbox mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() 2024-12-14 19:53:54 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:07:13 +00:00
md dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) 2025-01-17 13:34:43 +01:00
media media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg 2025-01-02 10:30:48 +01:00
memory memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() 2025-02-21 13:49:12 +01:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-07-19 16:21:08 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:53:40 +01:00
mfd mfd: syscon: Fix race in device_node_get_regmap() 2025-02-21 13:49:03 +01:00
misc misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config 2025-01-17 13:34:44 +01:00
mmc mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk 2024-12-27 13:52:55 +01:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data" 2025-01-23 17:17:11 +01:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() 2025-02-21 13:49:06 +01:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:25:02 +02:00
ntb ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition 2024-10-17 15:22:15 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 19:54:47 +01:00
nvme nvme: Add error check for xa_store in nvme_get_effects_log 2025-02-21 13:48:53 +01:00
nvmem nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc 2024-09-12 11:10:26 +02:00
of of: address: Preserve the flags portion on 1:1 dma-ranges mapping 2025-01-17 13:34:48 +01:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-21 13:49:02 +01:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport parport: Proper fix for array out-of-bounds access 2024-10-22 15:56:49 +02:00
pci Revert "PCI: Use preserve_config in place of pci_flags" 2025-01-23 17:17:15 +01:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:10:20 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf perf/arm-cmn: Ensure port and device id bits are set properly 2024-12-14 19:54:09 +01:00
phy phy: rockchip: naneng-combphy: fix phy reset 2025-01-02 10:30:50 +01:00
pinctrl pinctrl: stm32: Add check for clk_enable() 2025-02-21 13:49:08 +01:00
platform platform/x86: asus-nb-wmi: Ignore unknown event 0xCF 2025-01-02 10:30:52 +01:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: gpio-charger: Fix set charge current limits 2025-01-02 10:30:55 +01:00
powercap powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() 2024-11-01 01:56:05 +01:00
pps tty/serial: Make ->dcd_change()+uart_handle_dcd_change() status bool active 2024-11-01 01:56:02 +01:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init() 2024-12-19 18:08:53 +01:00
pwm pwm: stm32: Add check for clk_enable() 2025-02-21 13:49:05 +01:00
rapidio rapidio: devices: fix missing put_device in mport_cdev_open 2022-12-31 13:32:00 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: of: Implement the unwind path of of_regulator_match() 2025-02-21 13:49:02 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region 2024-12-14 19:53:47 +01:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-17 15:20:47 +02:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-14 19:53:47 +01:00
rtc rtc: cmos: avoid taking rtc_lock for extended period of time 2024-12-14 19:54:49 +01:00
s390 s390/cio: Do not unregister the subchannel based on DNV 2024-12-14 19:53:14 +01:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: storvsc: Ratelimit warning logs to prevent VM denial of service 2025-02-01 18:30:10 +01:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2024-12-27 13:52:58 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 11:56:20 +02:00
soc soc: atmel: fix device_node release in atmel_soc_device_init() 2025-02-21 13:49:09 +01:00
soundwire soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-09-18 19:23:06 +02:00
spi spi: zynq-qspi: Add check for clk_enable() 2025-02-21 13:48:59 +01:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:35:55 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:30:27 +02:00
staging staging: iio: ad9832: Correct phase range check 2025-01-17 13:34:43 +01:00
target scsi: target: core: Fix null-ptr-deref in target_alloc_device() 2024-11-01 01:56:00 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:49:17 +02:00
thermal thermal: of: fix OF node leak in of_thermal_zone_find() 2025-01-17 13:34:42 +01:00
thunderbolt thunderbolt: Don't display nvm_version unless upgrade supported 2025-01-09 13:29:56 +01:00
tty serial: amba-pl011: fix build regression 2024-12-14 19:54:55 +01:00
ufs scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers 2025-01-23 17:17:12 +01:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:10:26 +02:00
usb Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" 2025-02-01 18:30:11 +01:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-14 19:53:48 +01:00
vfio vfio/platform: check the bounds of read/write syscalls 2025-02-01 18:30:10 +01:00
vhost vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 2024-10-17 15:22:09 +02:00
video fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-12-14 19:53:42 +01:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:03:30 +02:00
virtio vdpa: Add eventfd for the vdpa callback 2024-10-17 15:21:12 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 2025-01-02 10:30:51 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-14 19:53:54 +01:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00