joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity
android_kernel_sony_sdm845/drivers
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Daniel Vetter a2f3c53b4c
 drm/vgem: Close use-after-free race in vgem_gem_create 
commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 upstream.

There's two references floating around here (for the object reference,
not the handle_count reference, that's a different thing):

- The temporary reference held by vgem_gem_create, acquired by
  creating the object and released by calling
  drm_gem_object_put_unlocked.

- The reference held by the object handle, created by
  drm_gem_handle_create. This one generally outlives the function,
  except if a 2nd thread races with a GEM_CLOSE ioctl call.

So usually everything is correct, except in that race case, where the
access to gem_object->size could be looking at freed data already.
Which again isn't a real problem (userspace shot its feet off already
with the race, we could return garbage), but maybe someone can exploit
this as an information leak.

Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Hillf Danton <hdanton@sina.com>
Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Cc: Emil Velikov <emil.velikov@collabora.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Eric Anholt <eric@anholt.net>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Rob Clark <robdclark@chromium.org>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Change-Id: Ie60eb85499e5fe3cd27118c03829faf9ab67d7bc
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch
[OP: backport to 4.19: adjusted DRM_DEBUG() -> DRM_DEBUG_DRIVER()]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[mkbestas: backport to 4.9]
Signed-off-by: Michael Bestas <mkbestas@lineageos.org>
2025-02-14 15:30:54 +02:00
..
accessibility
acpi This is the 4.9.337 stable release 2023-01-07 13:07:00 +01:00
amba ARM: 9120/1: Revert "amba: make use of -1 IRQs warn" 2021-11-12 13:18:01 +01:00
android UPSTREAM: binder: add flag to clear buffer on txn complete 2022-11-30 02:27:36 +02:00
ata ata: pata_legacy: fix pdc20230_set_piomode() 2022-11-10 15:46:05 +01:00
atm atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-25 11:09:29 +02:00
auxdisplay auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string 2021-11-26 11:48:38 +01:00
base BACKPORT: PM / core: Add support to skip power management in device/driver model 2024-09-20 15:33:29 +00:00
bcma
block Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-09-06 06:20:26 +03:00
bluetooth Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
bus Merge tag 'LA.UM.10.3.c25-02100-sdm845.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.9 into android13-4.9-sdm845 2024-04-20 00:36:50 +03:00
cdrom
char diag: Sanitize the mempools with pool data size check 2025-02-14 15:30:53 +02:00
clk Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
clocksource Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-07-18 14:05:31 +03:00
connector
cpufreq Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-09-06 06:20:26 +03:00
cpuidle Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
crypto Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
dax
dca
devfreq
dio drivers: dio: fix possible memory leak in dio_init() 2023-01-07 12:07:24 +01:00
dma Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845 2022-12-20 19:52:09 +02:00
dma-buf
edac Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-03-31 22:52:51 +03:00
eisa
esoc
extcon
firewire firewire: core: extend card->lock in fw_core_handle_bus_reset 2022-05-12 12:14:57 +02:00
firmware Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845 2022-11-09 19:25:28 +02:00
fmc
fpga
gpio Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into android13-4.9-sdm845 2023-01-06 17:47:31 +02:00
gpu drm/vgem: Close use-after-free race in vgem_gem_create 2025-02-14 15:30:54 +02:00
hid Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2023-01-07 12:07:27 +01:00
hv Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region 2022-09-28 10:55:47 +02:00
hwmon Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845 2022-12-20 19:52:09 +02:00
hwspinlock
hwtracing coresight: Fix clang 14.x forbidden warnings/errors 2024-02-12 18:33:54 +01:00
i2c Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
ide
idle
iio Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
infiniband Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
input Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
iommu iommu: Fix missing return check of arm_lpae_init_pte 2024-04-01 20:50:53 +03:00
ipack ipack: ipoctal: fix module reference leak 2021-10-06 10:23:42 +02:00
irqchip Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
isdn This is the 4.9.337 stable release 2023-01-07 13:07:00 +01:00
leds
lguest
lightnvm lightnvm: disable the subsystem 2022-05-12 12:14:53 +02:00
macintosh macintosh/macio-adb: check the return value of ioremap() 2023-01-07 12:07:28 +01:00
mailbox
mcb mcb: mcb-parse: fix error handing in chameleon_parse_gdd() 2023-01-07 12:07:26 +01:00
md ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree 2025-02-14 15:30:53 +02:00
media UPSTREAM: USB: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format 2025-02-06 16:16:59 +02:00
memory memory: of: Fix refcount leak bug in of_get_ddr_timings() 2022-10-26 13:15:40 +02:00
memstick memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() 2021-11-26 11:48:34 +01:00
message
mfd Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845 2022-11-09 19:25:28 +02:00
misc Merge tag 'LA.UM.8.3.c25-09700-sdm845.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.9 into android13-4.9-sdm845 2024-10-10 16:46:34 +03:00
mmc Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
mtd Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
net BACKPORT: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path 2025-02-14 15:30:54 +02:00
nfc Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
ntb
nubus
nvdimm
nvme nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices 2022-10-26 13:15:33 +02:00
nvmem Merge remote-tracking branch 'common/android-4.9-q' into lineage-18.1-caf-sdm845 2021-11-03 04:17:25 +02:00
of Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-07-18 14:05:31 +03:00
oprofile
parisc This is the 4.9.337 stable release 2023-01-07 13:07:00 +01:00
parport parport_pc: Avoid FIFO port location truncation 2022-11-25 17:35:39 +01:00
pci Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
pcmcia pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards 2022-06-14 16:52:36 +02:00
perf
phy Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-06-12 01:39:01 +03:00
pinctrl pinctrl: qcom: Using readl_relaxed/writel_relaxed APIs 2023-11-23 22:06:15 -08:00
platform ipa_v3: Fix enum conversion warnings 2023-10-24 11:11:29 +00:00
pnp PNP: fix name memory leak in pnp_alloc_dev() 2023-01-07 12:07:14 +01:00
power power: qpnp-smb2: Implement battery charging_enabled node 2023-05-24 04:22:43 +03:00
powercap powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue 2022-10-26 13:15:45 +02:00
pps
ps3
ptp ptp: replace snprintf with sysfs_emit 2022-04-20 09:06:42 +02:00
pwm Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845 2022-07-18 14:05:31 +03:00
rapidio rapidio: devices: fix missing put_device in mport_cdev_open 2023-01-07 12:07:15 +01:00
ras
regulator regulator: Fix error checking for debugfs_create_dir 2023-12-12 22:42:03 +00:00
remoteproc remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region 2022-04-20 09:06:36 +02:00
reset
rpmsg rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value 2022-06-14 16:52:37 +02:00
rtc Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
s390 s390/lcs: Fix return type of lcs_start_xmit() 2023-01-07 12:07:32 +01:00
sbus
scsi Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
sensors
sfi
sh maple: fix wrong return value of maple_bus_init(). 2021-11-26 11:48:41 +01:00
slimbus
sn
soc Merge tag 'LA.UM.8.3.c25-09700-sdm845.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.9 into android13-4.9-sdm845 2024-10-10 16:46:34 +03:00
spi Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845 2022-11-09 19:25:28 +02:00
spmi
ssb
staging Merge tag 'LA.UM.8.3.c25-09700-sdm845.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn into android13-4.9-sdm845 2024-10-10 16:47:58 +03:00
target scsi: target: iscsi: Make sure the np under each tpg is unique 2022-02-16 12:43:53 +01:00
tc
tee BACKPORT: tee: handle lookup of shm with reference count 0 2025-02-14 15:30:53 +02:00
thermal Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845 2022-11-09 19:25:28 +02:00
thunderbolt
tty Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
uio Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
usb ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request 2025-02-14 15:30:52 +02:00
uwb
vfio This is the 4.9.337 stable release 2023-01-07 13:07:00 +01:00
vhost vringh: Fix loop descriptors check in the indirect cases 2022-06-14 16:52:41 +02:00
video Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20 2023-01-19 15:42:12 +01:00
virt
virtio virtio_mmio: Restore guest page size on resume 2022-07-21 20:40:31 +02:00
vlynq
vme vme: Fix error not catched in fake_init() 2023-01-07 12:07:26 +01:00
vservices
w1 This is the 4.9.311 stable release 2022-04-21 14:01:02 +02:00
watchdog Merge remote-tracking branch 'common/android-4.9-q' into lineage-18.1-caf-sdm845 2021-12-27 02:07:39 +02:00
xen xen/platform-pci: add missing free_irq() in error path 2022-12-08 11:15:40 +01:00
zorro
Kconfig
Makefile