kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/media/mc
History
Mathias Krause a260bd22a3
 media: mc: fix potential use-after-free in media_request_alloc() 
Commit 6f504cbf10 ("media: convert media_request_alloc() to
FD_PREPARE()") moved the call to fd_install() (now hidden in
fd_publish()) before the snprintf(), making the later write to
potentially already freed memory, as userland is free to call
close() concurrently right after the call to fd_install() which
may end up in the request_fops.release() handler freeing 'req'.

Fixes: 6f504cbf10 ("media: convert media_request_alloc() to FD_PREPARE()")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Link: https://patch.msgid.link/20251209210903.603958-1-minipli@grsecurity.net
Signed-off-by: Christian Brauner <brauner@kernel.org>
History 2025-12-15 15:12:28 +01:00
..
Kconfig media: drop CONFIG_MEDIA_CONTROLLER_REQUEST_API 2023-11-23 13:03:45 +01:00
Makefile media: Fix Media Controller API config checks 2021-06-24 14:26:00 +02:00
mc-dev-allocator.c media: move drivers/media/media-* to drivers/media/mc/mc-* 2019-05-28 12:15:46 -04:00
mc-device.c media: drop CONFIG_MEDIA_CONTROLLER_REQUEST_API 2023-11-23 13:03:45 +01:00
mc-devnode.c media: mc: Clear minor number before put device 2025-09-10 10:42:13 +02:00
mc-entity.c media: mc: Improve unconnected pads debugging message in link exploration 2025-08-25 15:40:44 +02:00
mc-request.c media: mc: fix potential use-after-free in media_request_alloc() 2025-12-15 15:12:28 +01:00