mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-28 05:12:49 +00:00
Code Issues Releases Wiki Activity
No description
733757 commits 105 branches 5097 tags 5.5 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Find a file
Lin Ma 32557d09c1 media: dvbdev: fix refcnt bug 
commit 3a664569b7 upstream.

Previous commit initialize the dvbdev->ref before the template copy,
which will overwrite the reference and cause refcnt bug.

refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0
...
RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
RSP: 0000:ffffc900000678d0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c
RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 kref_get include/linux/kref.h:45 [inline]
 dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline]
 dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517
...

Just place the kref_init at correct position.

Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com
Fixes: 0fc044b2b5 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-18 09:26:35 +01:00
arch powerpc/hv-gpci: Fix hv_gpci event list 2023-01-18 09:26:28 +01:00
block blk-mq: fix possible memleak when register 'hctx' failed 2023-01-18 09:26:32 +01:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-25 11:46:44 +02:00
crypto crypto: drbg - make reseeding from get_random_bytes() synchronous 2022-06-25 11:46:41 +02:00
Documentation spi: Update reference to struct spi_controller 2023-01-18 09:26:12 +01:00
drivers media: dvbdev: fix refcnt bug 2023-01-18 09:26:35 +01:00
firmware Fix built-in early-load Intel microcode alignment 2020-01-23 08:20:30 +01:00
fs reiserfs: Add missing calls to reiserfs_security_free() 2023-01-18 09:26:34 +01:00
include mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 09:26:32 +01:00
init random: handle latent entropy and command line from random_init() 2022-06-25 11:46:40 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:16:33 +01:00
kernel gcov: add support for checksum field 2023-01-18 09:26:35 +01:00
lib test_firmware: fix memory leak in test_firmware_init() 2023-01-18 09:26:24 +01:00
mm mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths 2023-01-18 09:26:04 +01:00
net mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 09:26:32 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-26 11:40:31 +01:00
scripts kconfig: display recursive dependency resolution hint just once 2022-12-08 11:16:30 +01:00
security apparmor: fix a memleak in multi_transaction_new() 2023-01-18 09:26:21 +01:00
sound ASoC: rt5670: Remove unbalanced pm_runtime_put() 2023-01-18 09:26:34 +01:00
tools selftests/powerpc: Fix resource leaks 2023-01-18 09:26:28 +01:00
usr initramfs: restore default compression behavior 2020-04-13 10:34:19 +02:00
virt KVM: arm64: vgic: Fix exit condition in scan_its_table() 2022-11-03 23:50:50 +09:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: co-maintain random.c 2022-06-25 11:46:29 +02:00
Makefile Linux 4.14.302 2022-12-14 11:26:16 +01:00
README

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.