raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2026-01-02 15:53:42 +00:00
Code Issues Projects Releases Wiki Activity
Files
cfb5fb042ee1c8dbfbce53016f331c97c4f29411
linux/drivers
History
Ian Abbott 9ae4c50f5e staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf 
commit af4b54a2e5 upstream.

`ni6501_alloc_usb_buffers()` is called from `ni6501_auto_attach()` to
allocate RX and TX buffers for USB transfers.  It allocates
`devpriv->usb_rx_buf` followed by `devpriv->usb_tx_buf`.  If the
allocation of `devpriv->usb_tx_buf` fails, it frees
`devpriv->usb_rx_buf`, leaving the pointer set dangling, and returns an
error.  Later, `ni6501_detach()` will be called from the core comedi
module code to clean up.  `ni6501_detach()` also frees both
`devpriv->usb_rx_buf` and `devpriv->usb_tx_buf`, but
`devpriv->usb_rx_buf` may have already beed freed, leading to a
double-free error.  Fix it bu removing the call to
`kfree(devpriv->usb_rx_buf)` from `ni6501_alloc_usb_buffers()`, relying
on `ni6501_detach()` to free the memory.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-04-27 09:35:37 +02:00
..
accessibility
…
acpi
Revert "ACPI / EC: Remove old CLEAR_ON_RESUME quirk"
2019-04-20 09:15:06 +02:00
amba
ARM: amba: Don't read past the end of sysfs "driver_override" buffer
2018-05-01 12:58:21 -07:00
android
binder: fix race that allows malicious free of live buffer
2018-12-05 19:41:26 +01:00
ata
sata_rcar: fix deferred probing
2019-02-12 19:46:03 +01:00
atm
atm: he: fix sign-extension overflow on large shift
2019-02-27 10:08:05 +01:00
auxdisplay
auxdisplay: hd44780: Fix memory leak on ->remove()
2019-04-20 09:15:00 +02:00
base
mm: hide incomplete nr_indirectly_reclaimable in sysfs
2019-04-20 09:15:10 +02:00
bcma
…
block
floppy: check_events callback should not return a negative number
2019-03-23 14:35:12 +01:00
bluetooth
Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
2019-03-27 14:13:53 +09:00
bus
bus: arm-cci: remove unnecessary unreachable()
2018-12-01 09:42:49 +01:00
cdrom
cdrom: Fix race condition in cdrom_sysctl_register
2019-04-05 22:31:35 +02:00
char
tty: mark Siemens R3964 line discipline as BROKEN
2019-04-17 08:37:44 +02:00
clk
clk: rockchip: fix frac settings of GPLL clock for rk3328
2019-04-05 22:31:40 +02:00
clocksource
clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
2019-03-23 14:35:20 +01:00
connector
…
cpufreq
cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies
2019-04-05 22:31:31 +02:00
cpuidle
cpuidle: big.LITTLE: fix refcount leak
2019-02-12 19:46:03 +01:00
crypto
crypto: axis - fix for recursive locking from bottom half
2019-04-20 09:15:06 +02:00
dax
dev-dax: check_vma: ratelimit dev_info-s
2018-08-24 13:09:08 +02:00
dca
…
devfreq
PM / devfreq: Fix potential NULL pointer dereference in governor_store
2018-04-12 12:32:13 +02:00
dio
…
dma
dmaengine: tegra: avoid overflow of byte tracking
2019-04-05 22:31:40 +02:00
dma-buf
dma-buf: remove redundant initialization of sg_table
2018-06-05 11:41:57 +02:00
edac
EDAC, skx_edac: Fix logical channel intermediate decoding
2018-11-13 11:15:06 -08:00
eisa
…
extcon
extcon: Release locking when sending the notification of connector state
2018-09-09 19:55:56 +02:00
firewire
firewire-ohci: work around oversized DMA reads on JMicron controllers
2018-04-26 11:02:03 +02:00
firmware
efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
2019-04-05 22:31:36 +02:00
fmc
…
fpga
fpga: altera-cvp: Fix registration for CvP incapable devices
2019-02-12 19:45:58 +01:00
fsi
…
gpio
gpio: pxa: handle corner case of unprobed device
2019-04-20 09:15:04 +02:00
gpu
drm/amdkfd: use init_mqd function to allocate object for hid_mqd (CI)
2019-04-20 09:15:07 +02:00
hid
HID: i2c-hid: override HID descriptors for certain devices
2019-04-20 09:15:05 +02:00
hsi
…
hv
Drivers: hv: vmbus: Check for ring when getting debug info
2019-01-31 08:13:44 +01:00
hwmon
hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table
2019-02-27 10:08:05 +01:00
hwspinlock
…
hwtracing
coresight: cpu-debug: Support for CA73 CPUs
2019-04-20 09:15:07 +02:00
i2c
i2c: tegra: fix maximum transfer size
2019-03-23 14:35:25 +01:00
ide
ide: pmac: add of_node_put()
2018-12-21 14:13:14 +01:00
idle
intel_idle: Graceful probe failure when MWAIT is disabled
2018-08-09 12:16:39 +02:00
iio
io: accel: kxcjk1013: restore the range after resume.
2019-04-27 09:35:36 +02:00
infiniband
IB/mlx4: Fix race condition between catas error reset and aliasguid flows
2019-04-20 09:15:00 +02:00
input
Input: st-keyscan - fix potential zalloc NULL dereference
2019-03-23 14:35:13 +01:00
iommu
iommu/dmar: Fix buffer overflow during PCI bus notification
2019-04-20 09:15:06 +02:00
ipack
…
irqchip
irqchip/mbigen: Don't clear eventid when freeing an MSI
2019-04-20 09:15:03 +02:00
isdn
mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
2019-04-03 06:25:08 +02:00
leds
leds: lp55xx: fix null deref on firmware load failure
2019-04-05 22:31:33 +02:00
lightnvm
lightnvm: pblk: fix two sleep-in-atomic-context bugs
2018-11-13 11:14:52 -08:00
macintosh
macintosh/via-pmu: Add missing mmio accessors
2018-09-19 22:43:41 +02:00
mailbox
mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue
2019-03-23 14:35:15 +01:00
mcb
…
md
dm: disable CRYPTO_TFM_REQ_MAY_SLEEP to fix a GFP_KERNEL recursion deadlock
2019-04-20 09:15:08 +02:00
media
media: au0828: cannot kfree dev before usb disconnect
2019-04-20 09:15:04 +02:00
memory
memory: tegra: Apply interrupts mask per SoC
2018-08-03 07:50:38 +02:00
memstick
memstick: Prevent memstick host from getting runtime suspended during card detection
2019-02-12 19:46:04 +01:00
message
scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-05-25 16:17:47 +02:00
mfd
mfd: mc13xxx: Fix a missing check of a register-read failure
2019-02-27 10:08:03 +01:00
misc
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:15:06 +02:00
mmc
mmc: davinci: remove extraneous __init annotation
2019-04-20 09:15:00 +02:00
mtd
mtd: rawnand: gpmi: fix MX28 bus master lockup problem
2019-02-15 08:09:11 +01:00
mux
mux: core: fix double get_device()
2018-01-17 09:45:27 +01:00
net
net: thunderx: don't allow jumbo frames with XDP
2019-04-27 09:35:35 +02:00
nfc
NFC: nfcmrvl_uart: fix OF child-node lookup
2018-12-01 09:42:54 +01:00
ntb
ntb_transport: Fix bug with max_mw_size parameter
2018-04-26 11:02:13 +02:00
nubus
…
nvdimm
libnvdimm: Fix altmap reservation size calculation
2019-03-23 14:35:18 +01:00
nvme
nvme-pci: use the same attributes when freeing host_mem_desc_bufs.
2019-02-20 10:20:50 +01:00
nvmem
nvmem: Don't let a NULL cell_id for nvmem_cell_get() crash us
2018-08-24 13:09:14 +02:00
of
OF: properties: add missing of_node_put
2019-01-23 08:09:49 +01:00
oprofile
…
parisc
parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
2018-05-30 07:52:28 +02:00
parport
parport_pc: fix find_superio io compare code, should use equal test.
2019-03-23 14:35:24 +01:00
pci
PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
2019-04-17 08:37:55 +02:00
pcmcia
pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
2018-11-13 11:14:46 -08:00
perf
arm64: perf: Reject stand-alone CHAIN events for PMUv3
2018-10-18 09:16:24 +02:00
phy
phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
2019-04-03 06:25:19 +02:00
pinctrl
pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
2019-03-23 14:35:14 +01:00
platform
platform/x86: intel_pmc_core: Fix PCH IP sts reading
2019-04-05 22:31:35 +02:00
pnp
…
power
power: supply: charger-manager: Fix incorrect return value
2019-03-27 14:13:55 +09:00
powercap
…
pps
…
ps3
…
ptp
ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
2019-02-12 19:45:59 +01:00
pwm
pwm: meson: Fix mux clock names
2018-09-15 09:45:27 +02:00
rapidio
…
ras
…
regulator
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
2019-04-05 22:31:39 +02:00
remoteproc
remoteproc: qcom: Fix potential device node leaks
2018-06-21 04:02:48 +09:00
reset
reset: make device_reset_optional() really optional
2018-12-08 13:03:40 +01:00
rpmsg
rpmsg: smd: fix memory leak on channel create
2018-11-13 11:15:12 -08:00
rtc
rtc: Fix overflow when converting time64_t to rtc_time
2019-03-27 14:13:55 +09:00
s390
vfio: ccw: only free cp on final interrupt
2019-04-03 06:25:21 +02:00
sbus
drivers/sbus/char: add of_node_put()
2018-12-21 14:13:13 +01:00
scsi
scsi: iscsi: flush running unbind operations when removing a session
2019-04-20 09:15:01 +02:00
sfi
…
sh
…
sn
…
soc
soc/tegra: pmc: Drop locking from tegra_powergate_is_powered()
2019-04-20 09:15:06 +02:00
spi
spi: pxa2xx: Setup maximum supported DMA transfer length
2019-03-23 14:35:19 +01:00
spmi
…
ssb
…
staging
staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
2019-04-27 09:35:37 +02:00
target
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
2019-03-23 14:35:20 +01:00
tc
TC: Set DMA masks for devices
2018-11-13 11:15:11 -08:00
tee
tee: check shm references are consistent in offset/size
2018-06-21 04:02:54 +09:00
thermal
thermal/intel_powerclamp: fix truncated kthread name
2019-04-20 09:15:01 +02:00
thunderbolt
thunderbolt: Prevent crash when ICM firmware is not running
2018-04-24 09:36:29 +02:00
tty
serial: uartps: console_setup() can't be placed to init section
2019-04-20 09:15:04 +02:00
uio
Revert "uio: use request_threaded_irq instead"
2019-02-15 08:09:14 +01:00
usb
usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded
2019-04-05 22:31:37 +02:00
uwb
uwb: hwa-rc: fix memory leak at probe
2018-10-03 17:00:46 -07:00
vfio
vfio/type1: Fix task tracking for QEMU vCPU hotplug
2018-08-03 07:50:23 +02:00
vhost
vhost: reject zero size iova range
2019-04-27 09:35:34 +02:00
video
backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state
2019-04-05 22:31:37 +02:00
virt
…
virtio
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
2019-04-17 08:37:53 +02:00
vlynq
…
vme
…
w1
w1: omap-hdq: fix missing bus unregister at removal
2018-11-13 11:15:09 -08:00
watchdog
watchdog: renesas_wdt: don't set divider while watchdog is running
2019-02-12 19:46:03 +01:00
xen
xen/pvcalls: remove set but not used variable 'intf'
2019-02-27 10:08:03 +01:00
zorro
zorro: Set up z->dev.dma_mask for the DMA API
2018-05-30 07:52:30 +02:00
Kconfig
…
Makefile
usb: build drivers/usb/common/ when USB_SUPPORT is set
2018-02-25 11:07:53 +01:00