Zhou Qingyang
ccd4cf5e57
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() ...
[ Upstream commit 3af86b046933ba513d08399dba0d4d8b50d607d0 ]
In hexium_attach(dev, info), saa7146_vv_init() is called to allocate
a new memory for dev->vv_data. saa7146_vv_release() will be called on
failure of saa7146_register_device(). There is a dereference of
dev->vv_data in saa7146_vv_release(), which could lead to a NULL
pointer dereference on failure of saa7146_vv_init().
Fix this bug by adding a check of saa7146_vv_init().
This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.
Builds with CONFIG_VIDEO_HEXIUM_GEMINI=m show no new warnings,
and our static analyzer no longer warns about this code.
Link: https://lore.kernel.org/linux-media/20211203154030.111210-1-zhou1615@umn.edu
Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 08:47:37 +01:00
ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
2021-11-26 11:48:39 +01:00
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-12 13:18:01 +01:00
binder: use wake_up_pollfree()
2021-12-14 10:04:48 +01:00
libata: add horkage for ASMedia 1092
2021-12-14 10:04:48 +01:00
atm: nicstar: register the interrupt handler in the right place
2021-07-20 16:21:08 +02:00
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
2021-11-26 11:48:38 +01:00
regmap: Fix possible double-free in regcache_rbtree_exit()
2021-11-02 17:39:23 +01:00
bcma: Fix memory leak for internally-handled cores
2021-09-22 11:43:02 +02:00
floppy: Add max size check for user space request
2022-01-27 08:47:37 +01:00
Bluetooth: bfusb: fix division by zero in send path
2022-01-27 08:47:30 +01:00
bus: qcom: Put child node before return
2021-05-22 10:40:23 +02:00
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:29:07 +02:00
char/mwave: Adjust io port register size
2022-01-27 08:47:35 +01:00
clk: kirkwood: Fix a clocking boot regression
2021-09-22 11:43:02 +02:00
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
2021-03-03 17:44:37 +01:00
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
2021-10-06 10:23:41 +02:00
cpuidle: Fix kobject memory leaks in error paths
2021-11-26 11:48:33 +01:00
crypto: qce - fix uaf on qce_ahash_register_one
2022-01-27 08:47:33 +01:00
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 20:40:02 +02:00
dmaengine: pxa/mmp: stop referencing config->slave_id
2022-01-27 08:47:36 +01:00
EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
2021-11-26 11:48:22 +01:00
extcon: max8997: Add missing modalias string
2021-07-20 16:21:05 +02:00
firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
2021-04-07 12:05:40 +02:00
firmware: arm_scpi: Fix string overflow in SCPI genpd driver
2021-12-22 09:05:15 +01:00
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
2022-01-27 08:47:37 +01:00
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
2022-01-27 08:47:33 +01:00
HID: apple: Do not reset quirks when the Fn key is not found
2022-01-27 08:47:36 +01:00
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 08:47:37 +01:00
hyperv/vmbus: include linux/bitops.h
2021-11-26 11:48:20 +01:00
hwmon: (lm90) Do not report 'busy' status bit as alarm
2021-12-29 12:14:49 +01:00
intel_th: Consistency and off-by-one fix
2021-05-22 10:40:16 +02:00
i2c: rk3x: Handle a spurious start completion interrupt flag
2021-12-22 09:05:13 +01:00
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
2021-12-14 10:04:50 +01:00
RDMA/cxgb4: Set queue pair state when being queried
2022-01-27 08:47:36 +01:00
Input: spaceball - fix parsing of movement data packets
2022-01-05 12:31:25 +01:00
iommu/amd: Fix backport of 140456f994195b568ecd7fc2287a34eadffef3ca
2021-08-04 11:58:01 +02:00
ipack: ipoctal: fix module reference leak
2021-10-06 10:23:42 +02:00
irqchip: nvic: Fix offset for Interrupt Priority Offsets
2021-12-14 10:04:50 +01:00
mISDN: change function names to avoid conflicts
2022-01-11 13:38:13 +01:00
leds: ktd2692: Fix an error handling path
2021-07-20 16:21:05 +02:00
mcb: fix error handling in mcb_alloc_bus()
2021-10-06 10:23:39 +02:00
dm btree remove: fix use after free in rebalance_children()
2021-12-22 09:05:14 +01:00
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
2022-01-27 08:47:37 +01:00
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
2021-11-26 11:48:37 +01:00
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-26 11:48:34 +01:00
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-10 10:23:57 +01:00
mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
2022-01-27 08:47:31 +01:00
misc: lattice-ecp3-config: Fix task hung when firmware load failed
2022-01-27 08:47:36 +01:00
mmc: mxs-mmc: disable regulator on error and in the remove function
2021-11-26 11:48:35 +01:00
mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
2021-11-26 11:48:38 +01:00
net: bonding: debug: avoid printing debug logs when bond is not notifying peers
2022-01-27 08:47:37 +01:00
nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
2021-11-26 11:48:39 +01:00
NTB: hw: amd: fix an issue about leak system resources
2020-10-29 09:05:41 +01:00
libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-03 17:44:44 +01:00
nvme-pci: Fix an error handling path in 'nvme_probe()'
2021-09-22 11:42:57 +02:00
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-27 09:33:58 +02:00
of: Fix truncation of memory sizes on 32-bit platforms
2021-07-20 16:21:05 +02:00
parisc: Move pci_dev_is_behind_card_dino to where it is used
2021-09-26 13:36:18 +02:00
parport: remove non-zero check on count
2021-09-22 11:43:07 +02:00
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
2022-01-27 08:47:32 +01:00
pcmcia: fix setting of kthread task states
2022-01-27 08:47:35 +01:00
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
2021-07-20 16:21:05 +02:00
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
2021-09-22 11:43:04 +02:00
platform/x86: apple-gmux: use resource_size() with res
2022-01-05 12:31:24 +01:00
power: reset: ltc2952: Fix use of floating point literals
2022-01-11 13:38:13 +01:00
powercap: restrict energy meter to root access
2020-11-10 21:04:57 +01:00
powerpc/ps3: use dma_mapping_error()
2020-12-29 13:45:00 +01:00
ptp_pch: Load module automatically if ID matches
2021-10-17 10:05:39 +02:00
pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered
2021-09-26 13:36:18 +02:00
rapidio: handle create_workqueue() failure
2021-05-26 11:29:06 +02:00
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
2021-11-26 11:48:22 +01:00
remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
2021-02-23 13:59:14 +01:00
reset: ti-syscon: fix to_ti_syscon_reset_data macro
2021-07-28 09:14:24 +02:00
rtc: cmos: take rtc_lock while reading from CMOS
2022-01-27 08:47:31 +01:00
s390/sclp_vt220: fix console name to match device
2021-07-20 16:21:11 +02:00
scsi: ufs: Fix race conditions related to driver data
2022-01-27 08:47:35 +01:00
maple: fix wrong return value of maple_bus_init().
2021-11-26 11:48:41 +01:00
soc/tegra: fuse: Fix bitwise vs. logical OR warning
2021-12-22 09:05:14 +01:00
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
2022-01-27 08:47:34 +01:00
ssb: sdio: Don't overwrite const buffer if block_write fails
2021-07-20 16:20:57 +02:00
staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()
2022-01-27 08:47:31 +01:00
scsi: target: Fix alua_tg_pt_gps_count tracking
2021-11-26 11:48:41 +01:00
thermal: core: Reset previous low and high trip during thermal zone init
2021-12-08 08:45:05 +01:00
serial: amba-pl011: do not request memory region twice
2022-01-27 08:47:33 +01:00
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb: gadget: f_fs: Use stream_open() for endpoint files
2022-01-27 08:47:36 +01:00
vfio: Use config not menuconfig for VFIO_NOIOMMU
2021-09-22 11:43:04 +02:00
vhost/vsock: fix incorrect used length reported to the guest
2021-12-08 08:45:04 +01:00
vgacon: Propagate console boot parameters before calling `vc_resize'
2021-12-08 08:45:06 +01:00
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:05:35 +01:00
virtio_pci: Support surprise removal of virtio pci device
2022-01-11 13:38:11 +01:00
w1: mxc_w1: Fix timeout resolution problem leading to bus error
2020-11-10 10:23:57 +01:00
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
2021-11-26 11:48:38 +01:00
xen: detect uninitialized xenbus in xenbus_init
2021-12-08 08:45:02 +01:00
ccd4cf5e57