raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-28 04:52:52 +00:00
Code Issues Projects Releases Wiki Activity
Files
b520e574fdbffdef4bfb166515febfff167eaf24
linux/drivers
History
Masahiro Fujiwara b520e574fd gtp: fix an use-before-init in gtp_newlink() 
[ Upstream commit 5146743120 ]

*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.

RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
 <IRQ>
 gtp_encap_recv+0xc2/0x2e0 [gtp]
 ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
 udp_queue_rcv_one_skb+0x1fe/0x530
 udp_queue_rcv_skb+0x40/0x1b0
 udp_unicast_rcv_skb.isra.0+0x78/0x90
 __udp4_lib_rcv+0x5af/0xc70
 udp_rcv+0x1a/0x20
 ip_protocol_deliver_rcu+0xc5/0x1b0
 ip_local_deliver_finish+0x48/0x50
 ip_local_deliver+0xe5/0xf0
 ? ip_protocol_deliver_rcu+0x1b0/0x1b0

gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.

Fixes: 1e3a3abd8b ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
Link: https://lore.kernel.org/r/20201027114846.3924-1-fujiwara.masahiro@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-01 12:45:38 +01:00
..
accessibility
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
acpi
libnvdimm: Validate command family indices
2020-08-21 13:15:03 +02:00
amba
ARM: tegra: Replace zero-length array with flexible-array
2020-06-15 23:08:28 -05:00
android
binder: Remove bogus warning on failed same-process transaction
2020-10-29 10:07:34 +01:00
ata
libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
2020-09-09 19:14:30 +02:00
atm
atm: eni: fix the missed pci_disable_device() for eni_init_one()
2020-10-01 17:36:26 +02:00
auxdisplay
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
base
fs/kernel_read_file: Remove FIRMWARE_EFI_EMBEDDED enum
2020-11-01 12:45:36 +01:00
bcma
…
block
loop: Set correct device size when using LOOP_CONFIGURE
2020-09-23 12:59:49 +02:00
bluetooth
Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb
2020-10-29 10:08:27 +01:00
bus
bus: mhi: core: Fix the building of MHI module
2020-10-29 10:07:48 +01:00
cdrom
Merge branch 'work.sysctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-06-10 16:05:54 -07:00
char
ipmi_si: Fix wrong return value in try_smi_init()
2020-10-29 10:07:49 +01:00
clk
clk: imx8mq: Fix usdhc parents order
2020-10-29 10:08:08 +01:00
clocksource
hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functions
2020-10-29 10:07:45 +01:00
connector
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
counter
counter: 104-quad-8: Add lock guards - filter clock prescaler
2020-06-14 14:46:52 +01:00
cpufreq
cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier
2020-10-29 10:08:01 +01:00
cpuidle
cpuidle: psci: Fix suspicious RCU usage
2020-10-07 08:02:49 +02:00
crypto
chelsio/chtls: fix tls record info to user
2020-11-01 12:45:38 +01:00
dax
dm: Call proper helper to determine dax support
2020-09-23 13:00:03 +02:00
dca
…
devfreq
PM / devfreq: tegra30: Disable clock on error in probe
2020-10-01 17:36:31 +02:00
dio
maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2020-06-17 10:57:41 -07:00
dma
dmaengine: dw: Activate FIFO-mode for memory peripherals only
2020-10-29 10:08:29 +01:00
dma-buf
dmabuf: fix NULL pointer dereference in dma_buf_release()
2020-10-01 17:36:34 +02:00
edac
EDAC/ti: Fix handling of platform_get_irq() error
2020-10-29 10:07:14 +01:00
eisa
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
extcon
extcon: arizona: Fix runtime PM imbalance on error
2020-05-29 17:36:02 +09:00
firewire
firewire: ohci: Replace zero-length array with flexible-array
2020-06-15 23:08:31 -05:00
firmware
efi/arm64: libstub: Deal gracefully with EFI_RNG_PROTOCOL failure
2020-11-01 12:45:36 +01:00
fpga
fpga: dfl: fix bug in port reset handshake
2020-07-13 22:11:17 -07:00
fsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gnss
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gpio
gpiolib: Disable compat ->read() code in UML case
2020-10-14 11:55:48 +02:00
gpu
drm/amd/display: Screen corruption on dual displays (DP+USB-C)
2020-10-29 10:08:29 +01:00
greybus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hid
HID: ite: Add USB id match for Acer One S1003 keyboard dock
2020-10-29 10:08:26 +01:00
hsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hv
Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
2020-09-23 12:59:55 +02:00
hwmon
hwmon: (bt1-pvt) Wait for the completion with timeout
2020-10-29 10:07:26 +01:00
hwspinlock
…
hwtracing
coresight: etm4x: Fix save and restore of TRCVMIDCCTLR1 register
2020-10-29 10:07:46 +01:00
i2c
i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs
2020-10-29 10:08:17 +01:00
i3c
i3c: master: Fix error return in cdns_i3c_master_probe()
2020-10-29 10:08:01 +01:00
ide
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
idle
…
iio
iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling
2020-10-29 10:07:46 +01:00
infiniband
RDMA/rxe: Handle skb_clone() failure in rxe_recv.c
2020-10-29 10:08:03 +01:00
input
Input: sun4i-ps2 - fix handling of platform_get_irq() error
2020-10-29 10:08:09 +01:00
interconnect
interconnect: Show bandwidth for disabled paths as zero in debugfs
2020-09-23 12:59:50 +02:00
iommu
iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()
2020-10-29 10:07:46 +01:00
ipack
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
irqchip
irqchip/ingenic: Leave parent IRQ unmasked on suspend
2020-09-09 19:14:10 +02:00
isdn
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
leds
leds: core: Flush scheduled work for system suspend
2020-08-19 08:26:33 +02:00
lightnvm
lightnvm: fix out-of-bounds write to array devices->info[]
2020-10-29 10:08:15 +01:00
macintosh
macintosh/via-macii: Access autopoll_devs when inside lock
2020-08-19 08:26:45 +02:00
mailbox
mailbox: avoid timer start from callback
2020-10-29 10:08:04 +01:00
mcb
…
md
x86, powerpc: Rename memcpy_mcsafe() to copy_mc_to_{user, kernel}()
2020-11-01 12:45:37 +01:00
media
media: venus: core: Fix runtime PM imbalance in venus_probe
2020-10-29 10:08:21 +01:00
memory
memory: fsl-corenet-cf: Fix handling of platform_get_irq() error
2020-10-29 10:08:12 +01:00
memstick
memstick: Skip allocating card when removing host
2020-10-07 08:02:46 +02:00
message
scsi: mptfusion: Don't use GFP_ATOMIC for larger DMA allocations
2020-06-26 22:51:53 -04:00
mfd
mfd: sm501: Fix leaks in probe()
2020-10-29 10:07:47 +01:00
misc
eeprom: at25: set minimum read/write access stride to 1
2020-10-29 10:08:30 +01:00
mmc
mmc: sdio: Check for CISTPL_VERS_1 buffer size
2020-10-29 10:08:20 +01:00
most
staging: most: avoid null pointer dereference when iface is null
2020-08-19 08:26:27 +02:00
mtd
mtd: rawnand: ams-delta: Fix non-OF build warning
2020-10-29 10:08:00 +01:00
mux
…
net
gtp: fix an use-before-init in gtp_newlink()
2020-11-01 12:45:38 +01:00
nfc
NFC: st95hf: Fix memleak in st95hf_in_send_cmd
2020-09-17 13:55:32 +02:00
ntb
ntb: intel: Fix memleak in intel_ntb_pci_probe
2020-10-29 10:08:16 +01:00
nubus
…
nvdimm
x86, powerpc: Rename memcpy_mcsafe() to copy_mc_to_{user, kernel}()
2020-11-01 12:45:37 +01:00
nvme
nvmet: fix uninitialized work for zero kato
2020-10-29 10:08:16 +01:00
nvmem
nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()
2020-10-29 10:07:45 +01:00
of
of/address: check for invalid range.cpu_addr
2020-08-26 11:49:13 +02:00
opp
opp: Prevent memory leak in dev_pm_opp_attach_genpd()
2020-10-29 10:08:24 +01:00
oprofile
oprofile: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-19 08:27:07 +02:00
parport
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pci
PCI: hv: Fix hibernation in case interrupts are not re-created
2020-10-29 10:08:06 +01:00
pcmcia
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
perf
drivers/perf: thunderx2_pmu: Fix memory resource error handling
2020-10-29 10:07:14 +01:00
phy
phy: ti: am654: Fix a leak in serdes_am654_probe()
2020-10-07 08:02:50 +02:00
pinctrl
pinctrl: aspeed: Use the right pinconf mask
2020-10-29 10:07:46 +01:00
platform
platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command
2020-10-29 10:08:09 +01:00
pnp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
power
power: supply: check if calc_soc succeeded in pm860x_init_battery
2020-08-19 08:26:46 +02:00
powercap
Merge tag 'kbuild-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2020-06-13 13:29:16 -07:00
pps
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ps3
…
ptp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pwm
pwm: img: Fix null pointer access in probe
2020-10-29 10:08:06 +01:00
rapidio
rapidio: fix the missed put_device() for rio_mport_add_riodev
2020-10-29 10:08:03 +01:00
ras
RAS/CEC: Fix cec_init() prototype
2020-10-29 10:07:13 +01:00
regulator
regulator: resolve supply after creating regulator
2020-10-29 10:07:25 +01:00
remoteproc
remoteproc/mediatek: fix null pointer dereference on null scp pointer
2020-10-29 10:08:06 +01:00
reset
reset: intel: fix a compile warning about REG_OFFSET redefined
2020-08-19 08:26:09 +02:00
rpmsg
rpmsg: Avoid double-free in mtk_rpmsg_register_device
2020-10-29 10:08:05 +01:00
rtc
rtc: ds1307: Clear OSF flag on DS1388 when setting time
2020-10-29 10:08:04 +01:00
s390
s390/qeth: don't let HW override the configured port role
2020-10-29 10:08:29 +01:00
sbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
scsi
scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config()
2020-10-29 10:08:29 +01:00
sfi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
sh
…
siox
…
slimbus
slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback
2020-10-29 10:07:44 +01:00
soc
soc: mediatek: cmdq: add clear option in cmdq_pkt_wfe api
2020-10-29 10:08:15 +01:00
soundwire
soundwire: fix double free of dangling pointer
2020-09-17 13:55:28 +02:00
spi
spi: fsi: Fix clock running too fast
2020-10-29 10:08:19 +01:00
spmi
…
ssb
…
staging
staging: wfx: fix handling of MMIC error
2020-10-29 10:08:21 +01:00
target
scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
2020-10-29 10:07:48 +01:00
tc
…
tee
mmap locking API: use coccinelle to convert mmap_sem rwsem call sites
2020-06-09 09:39:14 -07:00
thermal
thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
2020-09-09 19:14:23 +02:00
thunderbolt
thunderbolt: Retry DROM read once if parsing fails
2020-09-23 13:00:01 +02:00
tty
tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
2020-10-29 10:08:30 +01:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-03 10:52:02 +02:00
usb
usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
2020-10-29 10:08:30 +01:00
vdpa
vdpa: ifcvf: free config irq in ifcvf_free_irq()
2020-09-03 11:29:29 +02:00
vfio
vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages
2020-10-29 10:08:08 +01:00
vhost
vhost-vdpa: fix page pinning leakage in error path
2020-10-14 11:55:57 +02:00
video
fbmem: add margin check to fb_check_caps()
2020-10-29 10:08:27 +01:00
virt
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 10:07:35 +01:00
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 11:49:07 +02:00
visorbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
vlynq
…
vme
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
w1
w1: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
watchdog
watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3
2020-10-29 10:08:07 +01:00
xen
xen/events: don't use chip_data for legacy IRQs
2020-10-07 08:02:47 +02:00
zorro
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
Kconfig
…
Makefile
…