kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Ricardo Ribalda 117f7a2975 media: uvcvideo: Remove dangling pointers 
commit 221cd51efe upstream.

When an async control is written, we copy a pointer to the file handle
that started the operation. That pointer will be used when the device is
done. Which could be anytime in the future.

If the user closes that file descriptor, its structure will be freed,
and there will be one dangling pointer per pending async control, that
the driver will try to use.

Clean all the dangling pointers during release().

To avoid adding a performance penalty in the most common case (no async
operation), a counter has been introduced with some logic to make sure
that it is properly handled.

Cc: stable@vger.kernel.org
Fixes: e5225c820c ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-03-13 12:51:12 +01:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi APEI: GHES: Have GHES honor the panic= setting 2025-03-13 12:50:19 +01:00
amba amba: bus: fix refcount leak 2023-09-19 12:22:47 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:07:51 +02:00
ata ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() 2024-12-19 18:07:17 +01:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-09-04 13:23:18 +02:00
auxdisplay auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() 2023-03-11 13:57:22 +01:00
base regmap-irq: Add missing kfree() 2025-03-13 12:50:41 +01:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block nbd: don't allow reconnect after disconnect 2025-03-13 12:49:51 +01:00
bluetooth Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 2024-10-22 15:40:45 +02:00
bus bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock 2025-03-13 12:51:10 +01:00
cdrom scsi: sr: cdrom: Move cdrom_read_cdda_bpc() into the sr driver 2021-07-30 22:13:09 -04:00
char tpm: Change to kvalloc() in eventlog/acpi.c 2025-03-13 12:50:49 +01:00
clk clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate 2025-03-13 12:50:25 +01:00
clocksource x86/i8253: Disable PIT timer 0 when not in use 2025-03-13 12:50:46 +01:00
comedi comedi: Flush partial mappings in error case 2024-12-14 19:51:13 +01:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter counter: stm32-timer-cnt: Add check for clk_enable() 2024-12-14 19:51:11 +01:00
cpufreq cpufreq: s3c64xx: Fix compilation warning 2025-03-13 12:50:23 +01:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:01:43 +02:00
crypto crypto: qce - unregister previously registered algos in error path 2025-03-13 12:50:31 +01:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-23 13:47:17 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-23 08:54:38 +01:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:14:27 +01:00
dma dmaengine: ti: edma: fix OF node reference leaks in edma_driver 2025-03-13 12:50:11 +01:00
dma-buf udmabuf: also check for F_SEAL_FUTURE_WRITE 2025-01-09 13:28:35 +01:00
edac EDAC/igen6: Avoid segmentation fault on module unload 2024-12-14 19:50:45 +01:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-16 13:39:39 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:51:01 +02:00
firmware efi: Avoid cold plugged memory for placing the kernel 2025-03-13 12:50:40 +01:00
fpga fpga: region: add owner module and take its refcount 2024-06-16 13:39:38 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-19 12:22:46 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: rcar: Fix missing of_node_put() call 2025-03-13 12:51:07 +01:00
gpu drm/sched: Fix preprocessor guard 2025-03-13 12:51:05 +01:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() 2025-03-13 12:51:04 +01:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2022-12-31 13:14:32 +01:00
hv Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet 2025-01-09 13:28:34 +01:00
hwmon hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() 2025-03-13 12:51:05 +01:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-12 11:07:41 +02:00
hwtracing intel_th: pci: Add Panther Lake-P/U support 2025-03-13 12:51:10 +01:00
i2c i2c: npcm: disable interrupt enable bit before devm_request_irq 2025-03-13 12:50:59 +01:00
i3c i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock 2024-12-14 19:51:42 +01:00
idle intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly 2025-03-13 12:51:00 +01:00
iio iio: light: as73211: fix channel handling in only-color triggered buffer 2025-03-13 12:50:30 +01:00
infiniband RDMA/mlx5: Fix bind QP error cleanup flow 2025-03-13 12:50:55 +01:00
input Input: xpad - add support for wooting two he (arm) 2025-02-01 18:24:02 +01:00
interconnect interconnect: qcom: sm8250: Enable sync_state 2024-10-17 15:11:06 +02:00
iommu iommu/arm-smmu: Defer probe of clients after smmu device bound 2024-12-14 19:51:34 +01:00
ipack ipack: ipoctal: fix module reference leak 2021-09-27 17:38:49 +02:00
irqchip irqchip/sunxi-nmi: Add missing SKIP_WAKE flag 2025-02-01 18:24:00 +01:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-19 05:45:25 +02:00
leds leds: lp8860: Write full EEPROM, not only half of it 2025-03-13 12:50:23 +01:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-19 05:45:06 +02:00
mailbox mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() 2024-12-14 19:51:04 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 16:56:31 +00:00
md md: select BLOCK_LEGACY_AUTOLOAD 2025-03-13 12:51:11 +01:00
media media: uvcvideo: Remove dangling pointers 2025-03-13 12:51:12 +01:00
memory memory: tegra20-emc: Correct memory device mask 2025-03-13 12:50:34 +01:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-07-23 13:46:52 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:51:02 +01:00
mfd mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id 2025-03-13 12:50:18 +01:00
misc eeprom: digsy_mtc: Make GPIO lookup table match the device 2025-03-13 12:51:10 +01:00
mmc mmc: sdhci-msm: Correctly set the load for the regulator 2025-03-13 12:50:19 +01:00
most most: fix control-message timeouts 2021-11-18 19:16:08 +01:00
mtd mtd: rawnand: cadence: fix unchecked dereference 2025-03-13 12:51:11 +01:00
mux mux: gpio: Simplify code by using dev_err_probe() 2021-04-02 16:28:53 +02:00
net ppp: Fix KMSAN uninit-value warning with bpf 2025-03-13 12:51:06 +01:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:23:40 +02:00
ntb ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition 2024-10-17 15:11:51 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:25:05 +01:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 19:51:41 +01:00
nvme nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch 2025-03-13 12:51:04 +01:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-03-13 12:50:32 +01:00
of Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" 2025-03-13 12:51:01 +01:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc parisc: iosapic.c: Fix sparse warnings 2023-10-06 13:18:15 +02:00
parport parport_pc: add support for ASIX AX99100 2025-03-13 12:50:46 +01:00
pci PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P 2025-03-13 12:50:36 +01:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:07:46 +02:00
perf perf: hisi: Fix use-after-free when register pmu fails 2023-11-20 11:08:21 +01:00
phy phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk 2025-03-13 12:51:00 +01:00
pinctrl pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking 2025-01-09 13:28:50 +01:00
platform platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e 2025-03-13 12:51:02 +01:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: da9150-fg: fix potential overflow 2025-03-13 12:50:53 +01:00
powercap powercap: RAPL: fix invalid initialization for pl4_supported field 2024-10-17 15:11:09 +02:00
pps pps: Fix a use-after-free 2025-03-13 12:50:47 +01:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp pps: Fix a use-after-free 2025-03-13 12:50:47 +01:00
pwm pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle 2024-12-14 19:50:48 +01:00
rapidio rapidio: fix an API misues when rio_add_net() fails 2025-03-13 12:51:03 +01:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: of: Implement the unwind path of of_regulator_match() 2025-03-13 12:49:57 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region 2024-12-14 19:51:07 +01:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-17 15:10:49 +02:00
rpmsg rpmsg: glink: Propagate TX failures in intentless mode as well 2024-12-14 19:51:19 +01:00
rtc rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read 2025-03-13 12:50:11 +01:00
s390 memblock: drop memblock_free_early_nid() and memblock_free_early() 2025-03-13 12:50:07 +01:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: core: Clear driver private data when retrying request 2025-03-13 12:50:55 +01:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-09 13:28:34 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-26 09:24:36 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:51:10 +01:00
soc soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove 2025-03-13 12:50:50 +01:00
soundwire soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-10-17 15:10:37 +02:00
spi spi-mxs: Fix chipselect glitch 2025-03-13 12:51:11 +01:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() 2025-03-13 12:50:09 +01:00
target scsi: target: core: Fix null-ptr-deref in target_alloc_device() 2024-11-01 01:52:34 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: Fix supplicant wait loop 2025-03-13 12:50:53 +01:00
thermal thermal: core: Initialize thermal zones before registering them 2024-12-14 19:50:44 +01:00
thunderbolt thunderbolt: Add support for Intel Panther Lake-M/P 2025-01-09 13:28:43 +01:00
tty serial: 8250_pci: add support for ASIX AX99100 2025-03-13 12:50:46 +01:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:07:51 +02:00
usb usb: xhci: Enable the TRB overfetch quirk on VIA VL805 2025-03-13 12:51:09 +01:00
vdpa RDMA/mlx5: Remove iova from struct mlx5_core_mkey 2025-03-13 12:50:07 +01:00
vfio vfio/pci: Enable iowrite64 and ioread64 for vfio pci 2025-03-13 12:50:36 +01:00
vhost vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 2024-10-17 15:11:47 +02:00
video fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() 2025-03-13 12:50:07 +01:00
virt drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl 2025-03-13 12:51:11 +01:00
virtio vdpa: Add eventfd for the vdpa callback 2024-10-17 15:11:06 +02:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-06-04 15:27:26 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme vme: Fix error not catched in fake_init() 2022-12-31 13:14:30 +01:00
w1 w1: fix loop in w1_fini() 2023-07-23 13:47:20 +02:00
watchdog watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 2025-01-09 13:28:39 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-14 19:51:11 +01:00
zorro zorro: Drop useless (and hardly used) .driver member in struct zorro_dev 2021-08-05 14:37:04 +02:00
Kconfig firmware: include drivers/firmware/Kconfig unconditionally 2021-10-07 16:51:26 +02:00
Makefile virtio: always enter drivers/virtio/ 2021-12-22 09:32:39 +01:00