korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-15 16:24:13 +08:00
Code Issues Packages Projects Releases Wiki Activity
717e4277dd
linux/include/media
History
Hyunwoo Kim a93ae93e9f media: dvb-core: Fix use-after-free due to race at dvb_register_device() 
commit 627bb528b0 upstream.

dvb_register_device() dynamically allocates fops with kmemdup()
to set the fops->owner.
And these fops are registered in 'file->f_ops' using replace_fops()
in the dvb_device_open() process, and kfree()d in dvb_free_device().

However, it is not common to use dynamically allocated fops instead
of 'static const' fops as an argument of replace_fops(),
and UAF may occur.
These UAFs can occur on any dvb type using dvb_register_device(),
such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc.

So, instead of kfree() the fops dynamically allocated in
dvb_register_device() in dvb_free_device() called during the
.disconnect() process, kfree() it collectively in exit_dvbdev()
called when the dvbdev.c module is removed.

Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-28 10:18:36 +02:00
..
davinci media: davinci/vpfe_capture.c: drop unused format descriptions 2019-07-25 06:30:00 -04:00
drv-intf media: media/platform: don't set description in ENUM_FMT 2019-07-22 14:43:59 -04:00
i2c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
tpg media: include/(uapi/)media: add SPDX license info 2018-02-14 13:23:51 -05:00
cec-notifier.h media: cec-notifier: add new notifier functions 2019-06-27 07:19:43 -04:00
cec-pin.h media: cec: add support for 5V signal testing 2018-07-25 07:11:48 -04:00
cec.h media: cec: add struct cec_connector_info support 2019-06-27 07:18:43 -04:00
demux.h media: dvb: update buffer mmaped flags and frame counter 2018-02-23 11:44:08 -05:00
dmxdev.h media: dmxdev: Fix the logic that enables DMA mmap support 2018-02-23 05:27:10 -05:00
dvb_ca_en50221.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
dvb_demux.h media: dvb: update buffer mmaped flags and frame counter 2018-02-23 11:44:08 -05:00
dvb_frontend.h media: dvb_frontend.h: Fix shifting signed 32-bit value problem 2019-08-14 05:04:08 -03:00
dvb_math.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
dvb_net.h media: dvb-core: Fix use-after-free due on race condition at dvb_net 2023-06-09 10:28:57 +02:00
dvb_ringbuffer.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
dvb_vb2.h media: dvb: update buffer mmaped flags and frame counter 2018-02-23 11:44:08 -05:00
dvb-usb-ids.h media: dvbsky: add support for eyeTV Geniatech T2 lite 2020-02-01 09:34:47 +00:00
dvbdev.h media: dvb-core: Fix use-after-free due to race at dvb_register_device() 2023-06-28 10:18:36 +02:00
fwht-ctrls.h media: vicodec: Introducing stateless fwht defs and structs 2019-03-25 14:02:30 -04:00
h264-ctrls.h media: uapi: h264: Get rid of the p0/b0/b1 ref-lists 2019-08-19 13:24:04 -03:00
imx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
media-dev-allocator.h media: Fix Media Controller API config checks 2021-07-14 16:53:15 +02:00
media-device.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
media-devnode.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
media-entity.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
media-request.h media: media requests: return EBADR instead of EACCES 2019-03-25 13:26:10 -04:00
mpeg2-ctrls.h media: cedrus: identify buffers by timestamp 2019-01-07 13:20:54 -05:00
rc-core.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 285 2019-06-05 17:36:37 +02:00
rc-map.h media: rc: compile rc-cec.c into rc-core 2021-03-17 17:03:40 +01:00
rcar-fcp.h media: rcar-fcp: convert to SPDX identifiers 2018-09-12 09:29:03 -04:00
soc_camera.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
tuner-types.h
tuner.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tveeprom.h
v4l2-async.h media: v4l2-async: Add v4l2_async_notifier_add_fwnode_remote_subdev 2019-07-25 08:03:03 -04:00
v4l2-clk.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
v4l2-common.h media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation 2022-11-03 23:56:54 +09:00
v4l2-ctrls.h media: v4l: ctrls: Add debug messages 2019-07-25 06:26:49 -04:00
v4l2-dev.h media: v4l2-ioctl: add QUIRK_INVERTED_CROP 2018-11-20 13:28:20 -05:00
v4l2-device.h media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros 2020-02-24 08:36:36 +01:00
v4l2-dv-timings.h media: cec/v4l2: move V4L2 specific CEC functions to V4L2 2018-09-24 09:11:04 -04:00
v4l2-event.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
v4l2-fh.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
v4l2-flash-led-class.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
v4l2-fwnode.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206 2019-05-30 11:29:53 -07:00
v4l2-image-sizes.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
v4l2-ioctl.h media: v4l: ctrls: Add debug messages 2019-07-25 06:26:49 -04:00
v4l2-mc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
v4l2-mediabus.h media: v4l2-fwnode: Return -EINVAL for invalid bus-type 2020-12-30 11:51:08 +01:00
v4l2-mem2mem.h Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
v4l2-rect.h media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments 2020-02-11 04:35:14 -08:00
v4l2-subdev.h media: subdev: disallow ioctl for saa6588/davinci 2021-07-19 08:53:17 +02:00
videobuf2-core.h media: vb2: Introduce a vb2_get_buffer accessor 2019-06-21 16:20:23 -04:00
videobuf2-dma-contig.h
videobuf2-dma-sg.h media: Change Andrzej Pietrasiewicz's e-mail address 2019-01-16 11:21:07 -05:00
videobuf2-dvb.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
videobuf2-memops.h media: videobuf2-vmalloc: get_userptr: buffers are always writable 2019-05-29 08:05:58 -04:00
videobuf2-v4l2.h media: vb2: vb2_find_timestamp: drop restriction on buffer state 2019-01-31 09:26:55 -02:00
videobuf2-vmalloc.h
videobuf-core.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
videobuf-dma-contig.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
videobuf-dma-sg.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
videobuf-vmalloc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
vp8-ctrls.h media: uapi: new file needs types.h 2019-07-23 08:19:32 -04:00
vsp1.h media: vsp1: drm: Implement writeback support 2019-03-18 17:24:14 +02:00