mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-23 09:19:51 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/video/fbdev
History
Hyunwoo Kim 8d924b262f fbdev: smscufx: Fix several use-after-free bugs 
commit cc67482c9e upstream.

Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-04 00:00:20 +09:00
..
aty fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
core fbdev/core: Remove remove_conflicting_pci_framebuffers() 2022-10-26 12:22:57 +02:00
geode fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
i810 video: fbdev: i810: use true,false for bool variables 2020-05-06 19:29:10 +02:00
intelfb video: fbdev: intelfb: Initialize value of stolen size 2022-06-20 14:33:05 +02:00
kyro video: fbdev: kyro: Error out if 'lineclock' equals zero 2022-04-11 08:23:49 +02:00
matrox fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
mb862xx video: fbdev: aty/matrox/...: Prepare cleanup of powerpc's asm/prom.h 2022-04-04 08:55:23 +02:00
mmp video: fbdev: mmp: replace usage of found with dedicated list iterator variable 2022-04-12 22:06:10 +02:00
nvidia video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow 2022-01-29 22:24:25 +01:00
omap fbdev: omap: Remove unnecessary print function dev_err() 2022-08-24 21:53:41 +02:00
omap2 fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
riva video: fbdev: riva: Error out if 'pixclock' equals zero 2021-07-26 20:06:03 +02:00
savage video: fbdev: savagefb: make a variable local 2022-01-30 19:37:03 +01:00
sis fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
vermilion remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
via video: fbdev: via: check the return value of kstrdup() 2022-02-22 09:00:09 +01:00
68328fb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
acornfb.c video: fbdev: acornfb: remove free_unused_pages() 2021-02-24 13:38:31 -08:00
acornfb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
amba-clcd.c video: fbdev: amba-clcd: Fix refcount leak bugs 2022-07-26 08:56:22 +02:00
amifb.c video: fbdev: amiga: Simplify amifb_pan_display() 2022-07-18 07:54:17 +02:00
arcfb.c video: fbdev: arcfb: remove redundant initialization of variable err 2021-07-21 13:09:21 +02:00
arkfb.c video: fbdev: arkfb: Check the size of screen before memset_io() 2022-08-05 18:44:15 +02:00
asiliantfb.c video: fbdev: asiliantfb: remove redundant assignment to variable Ftarget 2022-01-29 23:04:57 +01:00
atafb.c video: fbdev: atari: Remove backward bug-compatibility 2022-07-18 07:56:18 +02:00
atafb.h
atafb_iplan2p2.c
atafb_iplan2p4.c
atafb_iplan2p8.c
atafb_mfb.c
atafb_utils.h
atmel_lcdfb.c video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() 2022-01-30 19:38:35 +01:00
au1100fb.c video: fbdev: au1100fb: Drop unnecessary NULL ptr check 2022-06-20 20:19:50 +02:00
au1100fb.h video: fbdev: au1100fb: Spelling s/palette/palette/ 2022-02-16 10:54:42 +01:00
au1200fb.c video: fbdev: au1200fb: Make use of dma_mmap_coherent() 2022-01-29 22:24:25 +01:00
au1200fb.h
broadsheetfb.c fbdev: Use pageref offset for deferred-I/O writeback 2022-05-03 16:04:22 +02:00
bt431.h
bt455.h
bw2.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
c2p.h
c2p_core.h fbdev: c2p: Use BUILD_BUG() instead of custom solution 2020-03-09 11:12:19 +01:00
c2p_iplan2.c
c2p_planar.c
carminefb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
carminefb.h
carminefb_regs.h
cg3.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
cg6.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
cg14.c fbdev: cg14fb: use resource_size 2020-01-15 17:31:50 +01:00
chipsfb.c fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() 2022-08-24 21:47:09 +02:00
cirrusfb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
clps711x-fb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
cobalt_lcdfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
controlfb.c video: fbdev: aty/matrox/...: Prepare cleanup of powerpc's asm/prom.h 2022-04-04 08:55:23 +02:00
controlfb.h
cyber2000fb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
cyber2000fb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
da8xx-fb.c video: fbdev: da8xx-fb: Make use of the helper function dev_err_probe() 2022-01-29 23:22:36 +01:00
dnfb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
edid.h
efifb.c Merge drm/drm-next into drm-misc-next 2022-06-20 18:21:25 +02:00
ep93xx-fb.c video: ep93xx: Prepare clock before using it 2021-07-26 22:10:29 +02:00
ffb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
fm2fb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
fsl-diu-fb.c video: fbdev: fsl-diu-fb: remove unneeded variable 'res' 2020-10-17 08:23:14 +02:00
g364fb.c fbdev/g364fb: Fix build failure 2020-02-19 10:58:22 -08:00
gbefb.c video: fbdev: gbefb: Only instantiate device when built for IP32 2021-10-06 11:12:28 +02:00
goldfishfb.c video: fbdev: goldfishfb: Fix defined but not used warning 2020-12-08 18:34:50 +01:00
grvga.c video: fbdev: Replace HTTP links with HTTPS ones 2020-07-20 11:47:29 +02:00
gxt4500.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
hecubafb.c fbdev: Rename pagelist to pagereflist for deferred I/O 2022-05-03 16:04:22 +02:00
hgafb.c video: hgafb: correctly handle card detect failure during probe 2021-05-21 15:04:05 +02:00
hitfb.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
hpfb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
hyperv_fb.c PCI: Move PCI_VENDOR_ID_MICROSOFT/PCI_DEVICE_ID_HYPERV_VIDEO definitions to pci_ids.h 2022-09-05 17:00:54 +00:00
i740_reg.h
i740fb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
imsttfb.c video: imsttfb: check for ioremap() failures 2021-05-13 18:58:39 +02:00
imxfb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
Kconfig drm: Implement DRM aperture helpers under video/ 2022-06-27 11:07:55 +02:00
leo.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
macfb.c video: fbdev: Replace HTTP links with HTTPS ones 2020-07-20 11:47:29 +02:00
macmodes.c
macmodes.h
Makefile ARM: omap1: move lcd_dma code into omapfb driver 2022-04-21 15:00:45 +02:00
maxinefb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
metronomefb.c fbdev: Use pageref offset for deferred-I/O writeback 2022-05-03 16:04:22 +02:00
mx3fb.c dmaengine: imx: Move header to include/dma/ 2022-04-19 12:06:18 +01:00
n411.c
neofb.c video: fbdev: neofb: Fix the check of 'var->pixclock' 2022-04-11 08:23:49 +02:00
ocfb.c video: fbdev: ocfb: add const to of_device_id 2022-01-29 22:24:25 +01:00
offb.c video: fbdev: offb: Include missing linux/platform_device.h 2022-07-28 16:22:12 +10:00
p9100.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
platinumfb.c video: fbdev: aty/matrox/...: Prepare cleanup of powerpc's asm/prom.h 2022-04-04 08:55:23 +02:00
platinumfb.h
pm2fb.c fbdev: fb_pm2fb: Avoid potential divide by zero error 2022-08-24 21:47:08 +02:00
pm3fb.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
pmag-aa-fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
pmag-ba-fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
pmagb-b-fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
ps3fb.c powerpc/ps3: make system bus's remove and shutdown callbacks return void 2020-12-04 01:01:22 +11:00
pvr2fb.c video: fbdev: pvr2fb: initialize variables 2020-08-05 19:47:22 +02:00
pxa3xx-gcu.c video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write 2022-06-20 20:12:17 +02:00
pxa3xx-gcu.h
pxa3xx-regs.h ARM: pxa: move regs-lcd.h into driver 2022-04-19 16:29:03 +02:00
pxa168fb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
pxa168fb.h
pxafb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
pxafb.h video: pxafb: Remove cpufreq policy notifier 2019-08-26 10:02:02 +02:00
q40fb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
s1d13xxxfb.c video: fbdev: s1d13xxxfb: Fix kernel-doc and set but not used warnings 2020-11-29 22:51:07 +01:00
s3c-fb.c drm for 5.18-rc1 2022-03-24 16:19:43 -07:00
s3c2410fb-regs-lcd.h fbdev: s3c2410fb: remove mach header dependency 2020-08-20 17:48:12 +02:00
s3c2410fb.c fbdev: s3c2410fb: remove mach header dependency 2020-08-20 17:48:12 +02:00
s3c2410fb.h
s3fb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
sa1100fb.c video: fbdev: sa1100fb: Remove unused sa1100fb_setup() 2022-07-18 07:54:18 +02:00
sa1100fb.h ARM/fbdev: sa11x0: Switch to use GPIO descriptors 2020-04-17 15:50:11 +02:00
sbuslib.c fbdev: sbuslib: remove compat_alloc_user_space usage 2020-09-25 16:34:50 +02:00
sbuslib.h
sh7760fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
sh_mobile_lcdcfb.c fbdev: Use pageref offset for deferred-I/O writeback 2022-05-03 16:04:22 +02:00
sh_mobile_lcdcfb.h fbdev/sh_mobile: remove sh_mobile_lcdc_display_notify 2019-06-12 20:28:11 +02:00
simplefb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
skeletonfb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
sm501fb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
sm712.h
sm712fb.c video: fbdev: sm712fb: Fix crash in smtcfb_write() 2022-03-03 11:13:40 +01:00
smscufx.c fbdev: smscufx: Fix several use-after-free bugs 2022-11-04 00:00:20 +09:00
ssd1307fb.c fbdev: ssd1307fb: Fix repeated words in comments 2022-08-24 21:47:08 +02:00
sstfb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
sticore.h parisc/stifb: Keep track of hardware path of graphics card 2022-06-04 15:47:03 +02:00
stifb.c fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards 2022-11-04 00:00:20 +09:00
sunxvr500.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
sunxvr1000.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
sunxvr2500.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
tcx.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
tdfxfb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
tgafb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
tmiofb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
tridentfb.c fbdev: Move fbdev drivers from strlcpy to strscpy 2022-08-24 22:06:15 +02:00
udlfb.c fbdev: Use pageref offset for deferred-I/O writeback 2022-05-03 16:04:22 +02:00
uvesafb.c video: fbdev: uvesafb: Fix set but not used warning 2020-12-08 18:33:48 +01:00
valkyriefb.c video: fbdev: Make *fb_setup() and *fb_init() static 2022-07-18 07:54:20 +02:00
valkyriefb.h
vesafb.c video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup 2022-05-28 19:26:56 +02:00
vfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
vga16fb.c drm-misc-next for v5.18: 2022-02-01 19:02:41 +10:00
vt8500lcdfb.c video: vt8500lcdfb: fix fallthrough warning 2020-04-17 15:50:08 +02:00
vt8500lcdfb.h
vt8623fb.c video: fbdev: vt8623fb: Check the size of screen before memset_io() 2022-08-05 18:44:14 +02:00
w100fb.c video: fbdev: w100fb: Reset global state 2022-01-29 22:24:26 +01:00
w100fb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm8505fb.c video: fbdev: wm8505fb: fix sparse warnings about using incorrect types 2020-03-02 16:32:04 +01:00
wm8505fb_regs.h
wmt_ge_rops.c video: fbdev: wmt_ge_rops: Fix function not declared warnings 2020-12-08 18:34:36 +01:00
wmt_ge_rops.h
xen-fbfront.c fbdev fixes and updates for kernel v5.19-rc1 2022-05-30 12:46:49 -07:00
xilinxfb.c video: fbdev: Fix fall-through warning for Clang 2021-07-13 13:58:29 -05:00