Hans Verkuil
e89662f06a
media: vb2: vb2_mmap: move lock up ...
commit cd26d1c4d1bc947b56ae404998ae2276df7b39b7 upstream.
If a filehandle is dup()ped, then it is possible to close it from one fd
and call mmap from the other. This creates a race condition in vb2_mmap
where it is using queue data that __vb2_queue_free (called from close())
is in the process of releasing.
By moving up the mutex_lock(mmap_lock) in vb2_mmap this race is avoided
since __vb2_queue_free is called with the same mutex locked. So vb2_mmap
now reads consistent buffer data.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Reported-by: syzbot+be93025dd45dccd8923c@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-23 08:10:55 +01:00
ACPI: power: Skip duplicate power resource references in _PRx
2019-01-16 22:12:32 +01:00
ARM: amba: Don't read past the end of sysfs "driver_override" buffer
2018-05-01 15:13:08 -07:00
binder: fix proc->files use-after-free
2018-12-08 13:05:07 +01:00
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
2018-12-21 14:11:37 +01:00
atm: zatm: Fix potential Spectre v1
2018-07-22 14:27:36 +02:00
auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
2018-02-13 12:35:55 +01:00
platform-msi: Free descriptors in platform_msi_domain_free()
2019-01-09 16:16:43 +01:00
rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
2019-01-16 22:12:32 +01:00
Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"
2018-11-27 16:09:40 +01:00
bus: arm-cci: remove unnecessary unreachable()
2018-12-05 19:42:41 +01:00
cdrom: fix improper type cast, which can leat to information leak.
2018-11-21 09:25:57 +01:00
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
2019-01-09 16:16:45 +01:00
clk: rockchip: fix typo in rk3188 spdif_frac parent
2019-01-09 16:16:44 +01:00
clockevents/drivers/i8253: Add support for PIT shutdown quirk
2018-11-21 09:26:01 +01:00
cpufreq: imx6q: add return value check for voltage scale
2018-12-01 09:44:20 +01:00
cpuidle: powernv: Fix promotion from snooze if next state disabled
2018-07-03 11:23:08 +02:00
crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK
2019-01-23 08:10:55 +01:00
device-dax: implement ->split() to catch invalid munmap attempts
2018-02-28 10:18:33 +01:00
PM / devfreq: Fix potential NULL pointer dereference in governor_store
2018-04-13 19:48:09 +02:00
dmaengine: cppi41: delete channel from pending list when stop channel
2018-12-13 09:20:29 +01:00
dma-buf: remove redundant initialization of sg_table
2018-06-06 16:44:33 +02:00
EDAC, skx_edac: Fix logical channel intermediate decoding
2018-11-13 11:16:56 -08:00
firewire-ohci: work around oversized DMA reads on JMicron controllers
2018-05-30 07:50:18 +02:00
efi/libstub: Make file I/O chunking x86-specific
2018-12-05 19:42:42 +01:00
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
2018-12-29 13:40:15 +01:00
drm/vc4: Set ->is_yuv to false when num_planes == 1
2019-01-13 10:03:55 +01:00
HID: input: Ignore battery reported by Symbol DS4308
2018-12-13 09:20:25 +01:00
HSI: ssi_protocol: double free in ssip_pn_xmit()
2018-03-24 11:00:12 +01:00
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
2018-12-29 13:40:15 +01:00
hwmon: (w83795) temp4_type has writable permission
2018-12-17 09:38:32 +01:00
intel_th: msu: Fix an off-by-one in attribute store
2019-01-13 10:03:55 +01:00
i2c: dev: prevent adapter retries and timeout being set as minus value
2019-01-16 22:12:32 +01:00
ide: pmac: add of_node_put()
2018-12-21 14:11:37 +01:00
idle: i7300: add PCI dependency
2018-02-25 11:05:55 +01:00
iio:st_magn: Fix enable device after trigger
2018-12-05 19:42:41 +01:00
rxe: fix error completion wr_id and qp_num
2019-01-13 10:03:53 +01:00
Input: omap-keypad - fix idle configuration to not block SoC idle states
2019-01-13 10:03:48 +01:00
iommu/vt-d: Handle domain agaw being less than iommu agaw
2019-01-13 10:03:53 +01:00
irqchip/bcm7038-l1: Hide cpu offline callback when building for !SMP
2018-09-15 09:42:58 +02:00
isdn: fix kernel-infoleak in capi_unlocked_ioctl
2019-01-09 16:16:40 +01:00
leds: pca955x: Correct I2C Functionality
2018-04-13 19:48:03 +02:00
macintosh/rack-meter: Convert cputime64_t use to u64
2018-10-20 09:51:32 +02:00
mailbox: xgene-slimpro: Fix potential NULL pointer dereference
2018-09-09 20:01:19 +02:00
MD: fix invalid stored role for a disk - try2
2018-11-13 11:17:05 -08:00
media: vb2: vb2_mmap: move lock up
2019-01-23 08:10:55 +01:00
memory: tegra: Apply interrupts mask per SoC
2018-08-03 07:55:24 +02:00
scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-05-25 16:13:06 +02:00
mfd: tps6586x: Handle interrupts on suspend
2019-01-23 08:10:55 +01:00
genwqe: Fix size check
2019-01-13 10:03:55 +01:00
mmc: omap_hsmmc: fix DMA API warning
2018-12-29 13:40:15 +01:00
mtd: atmel-quadspi: disallow building on ebsa110
2019-01-09 16:16:42 +01:00
bonding: update nest level on unlink
2019-01-23 08:10:54 +01:00
NFC: nxp-nci: Include unaligned.h instead of access_ok.h
2019-01-09 16:16:39 +01:00
ntb_transport: Fix bug with max_mw_size parameter
2018-05-30 07:50:22 +02:00
libnvdimm: Hold reference on parent while scheduling async init
2018-11-13 11:16:55 -08:00
nvmet-rdma: fix response use after free
2018-12-21 14:11:39 +01:00
nvmem: properly handle returned value nvmem_reg_read
2018-08-03 07:55:22 +02:00
of: add helper to lookup compatible child node
2018-12-01 09:44:21 +01:00
parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
2018-05-30 07:50:43 +02:00
parport: sunbpp: fix error return code
2018-09-26 08:36:38 +02:00
PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
2018-11-13 11:16:56 -08:00
pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
2018-11-13 11:16:46 -08:00
drivers/perf: arm_pmu: handle no platform_device
2018-03-22 09:17:51 +01:00
phy: work around 'phys' references to usb-nop-xceiv devices
2018-01-23 19:57:07 +01:00
pinctrl: meson: fix pull enable register calculation
2019-01-13 10:03:47 +01:00
platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
2018-11-27 16:09:38 +01:00
power: supply: olpc_battery: correct the temperature units
2019-01-13 10:03:55 +01:00
PowerCap: Fix an error code in powercap_register_zone()
2018-04-13 19:47:56 +02:00
ptp: fix Spectre v1 vulnerability
2018-11-10 07:43:00 -08:00
pwm: tiehrpwm: Fix disabling of output of PWMs
2018-09-09 20:01:25 +02:00
regulator: fix crash caused by null driver data
2018-10-03 17:01:49 -07:00
reset: make device_reset_optional() really optional
2018-12-08 13:05:08 +01:00
rpmsg: smd: fix memory leak on channel create
2018-11-13 11:17:03 -08:00
rtc: m41t80: Correct alarm month range with RTC reads
2019-01-09 16:16:45 +01:00
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
2019-01-13 10:03:50 +01:00
drivers/sbus/char: add of_node_put()
2018-12-21 14:11:36 +01:00
scsi: sd: Fix cache_type_store()
2019-01-23 08:10:54 +01:00
soc/tegra: pmc: Fix child-node lookup
2018-11-13 11:17:04 -08:00
spi: bcm2835: Unbreak the build of esoteric configs
2019-01-09 16:16:45 +01:00
staging: wilc1000: fix missing read_write setting when reading data
2019-01-09 16:16:43 +01:00
scsi: target: iscsi: cxgbit: fix csk leak
2019-01-23 08:10:53 +01:00
TC: Set DMA masks for devices
2018-11-13 11:17:02 -08:00
thermal: of-thermal: disable passive polling when thermal zone is disabled
2018-10-03 17:01:51 -07:00
thunderbolt: Resume control channel after hibernation image is created
2018-04-24 09:34:12 +02:00
tty: Don't hold ldisc lock in tty_reopen() if ldisc present
2019-01-23 08:10:53 +01:00
uio: Fix an Oops on load
2018-11-27 16:09:41 +01:00
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
2019-01-16 22:12:31 +01:00
uwb: hwa-rc: fix memory leak at probe
2018-10-03 17:01:42 -07:00
vfio: platform: Fix reset module leak in error path
2018-08-03 07:55:13 +02:00
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
2019-01-13 10:03:51 +01:00
omap2fb: Fix stack memory disclosure
2019-01-23 08:10:55 +01:00
virtio: pci-legacy: Validate queue pfn
2018-09-15 09:42:57 +02:00
w1: omap-hdq: fix missing bus unregister at removal
2018-11-13 11:17:01 -08:00
watchdog: sbsa: use 32-bit read for WCV
2018-05-30 07:50:34 +02:00
xen: xlate_mmu: add missing header to fix 'W=1' warning
2018-12-17 09:38:34 +01:00
zorro: Set up z->dev.dma_mask for the DMA API
2018-05-30 07:50:44 +02:00
usb: build drivers/usb/common/ when USB_SUPPORT is set
2018-02-25 11:05:45 +01:00
e89662f06a