diff mbox series

[5.10,148/663] media: allegro: Fix use after free on error

Message ID	20210301161149.094815852@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>, Michael Tretter <m.tretter@pengutronix.de>, Hans Verkuil <hverkuil-cisco@xs4all.nl>, Mauro Carvalho Chehab <mchehab+huawei@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 148/663] media: allegro: Fix use after free on error Date: Mon, 1 Mar 2021 17:06:36 +0100 Message-Id: <20210301161149.094815852@linuxfoundation.org> In-Reply-To: <20210301161141.760350206@linuxfoundation.org> References: <20210301161141.760350206@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/663] vdpa/mlx5: fix param validation in mlx5_vdpa_get_config() [5.10,005/663] scsi: libsas: docs: Remove notify_ha_event() [5.10,006/663] scsi: qla2xxx: Fix mailbox Ch erroneous error [5.10,007/663] kdb: Make memory allocations more robust [5.10,011/663] virt: vbox: Do not use wait_event_interruptible when called from kernel context [5.10,012/663] bfq: Avoid false bfq queue merging [5.10,020/663] drm/i915/gt: One more flush for Baytrail clear residuals [5.10,022/663] Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe fun... [5.10,023/663] Bluetooth: hci_uart: Fix a race for write_work scheduling [5.10,026/663] arm64: dts: renesas: beacon: Fix audio-1.8V pin enable [5.10,029/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato [5.10,032/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family [5.10,033/663] arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 [5.10,035/663] memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops [5.10,036/663] Bluetooth: hci_qca: Fix memleak in qca_controller_memdump [5.10,037/663] staging: vchiq: Fix bulk userdata handling [5.10,039/663] arm64: dts: qcom: msm8916-samsung-a5u: Fix iris compatible [5.10,041/663] bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h [5.10,042/663] bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args [5.10,046/663] arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card [5.10,051/663] cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() [5.10,052/663] arm64: dts: rockchip: rk3328: Add clock_in_out property to gmac2phy node [5.10,053/663] ACPICA: Fix exception code class checks [5.10,054/663] usb: gadget: u_audio: Free requests only after callback [5.10,055/663] arm64: dts: qcom: sdm845-db845c: Fix reset-pin of ov8856 node [5.10,056/663] soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model() [5.10,060/663] Bluetooth: Put HCI device if inquiry procedure interrupts [5.10,061/663] memory: ti-aemif: Drop child node when jumping out loop [5.10,063/663] usb: dwc2: Do not update data length if it is 0 on inbound transfers [5.10,064/663] usb: dwc2: Abort transaction after errors with unknown reason [5.10,065/663] usb: dwc2: Make "trimming xfer length" a debug message [5.10,067/663] x86/MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too [5.10,068/663] arm64: dts: renesas: beacon: Fix EEPROM compatible value [5.10,070/663] ARM: dts: armada388-helios4: assign pinctrl to LEDs [5.10,071/663] ARM: dts: armada388-helios4: assign pinctrl to each fan [5.10,072/663] arm64: dts: armada-3720-turris-mox: rename u-boot mtd partition to a53-firmware [5.10,073/663] opp: Correct debug message in _opp_add_static_v2() [5.10,075/663] soc: qcom: ocmem: dont return NULL in of_get_ocmem [5.10,076/663] arm64: dts: msm8916: Fix reserved and rfsa nodes unit address [5.10,077/663] arm64: dts: meson: fix broken wifi node for Khadas VIM3L [5.10,078/663] iwlwifi: mvm: set enabled in the PPAG command properly [5.10,079/663] ARM: s3c: fix fiq for clang IAS [5.10,080/663] optee: simplify i2c access [5.10,081/663] staging: wfx: fix possible panic with re-queued frames [5.10,082/663] ARM: at91: use proper asm syntax in pm_suspend [5.10,084/663] ath10k: Fix lockdep assertion warning in ath10k_sta_statistics [5.10,087/663] iwlwifi: mvm: fix the type we use in the PPAG table validity checks [5.10,088/663] iwlwifi: mvm: store PPAG enabled/disabled flag properly [5.10,089/663] iwlwifi: mvm: send stored PPAG command instead of local [5.10,090/663] iwlwifi: mvm: assign SAR table revision to the command later [5.10,093/663] iwlwifi: pnvm: set the PNVM again if it was already loaded [5.10,095/663] ath9k: fix data bus crash when setting nf_override via debugfs [5.10,096/663] selftests/bpf: Convert test_xdp_redirect.sh to bash [5.10,097/663] ibmvnic: Set to CLOSED state even on error [5.10,098/663] bnxt_en: reverse order of TX disable and carrier off [5.10,099/663] bnxt_en: Fix devlink infos stored fw.psid version format. [5.10,102/663] net: phy: consider that suspend2ram may cut off PHY power [5.10,103/663] net/mlx5e: Dont change interrupt moderation params when DIM is enabled [5.10,105/663] net/mlx5: Fix health error state handling [5.10,106/663] net/mlx5e: Replace synchronize_rcu with synchronize_net [5.10,107/663] net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context [5.10,110/663] net/mlx5: Disallow RoCE on lag device [5.10,111/663] net/mlx5: Disable devlink reload for lag devices [5.10,112/663] net/mlx5e: CT: manage the lifetime of the ct entry object [5.10,113/663] net/mlx5e: Check tunnel offload is required before setting SWP [5.10,115/663] libbpf: Ignore non function pointer member in struct_ops [5.10,123/663] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case [5.10,124/663] bpf: Clear subreg_def for global function return values [5.10,125/663] ibmvnic: add memory barrier to protect long term buffer [5.10,128/663] net: dsa: felix: dont deinitialize unused ports [5.10,129/663] net: phy: mscc: adding LCPLL reset to VSC8514 [5.10,132/663] net: amd-xgbe: Reset link when the link never comes back [5.10,133/663] net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP [5.10,134/663] net: mvneta: Remove per-cpu queue mapping for Armada 3700 [5.10,139/663] drm/gma500: Fix error return code in psb_driver_load() [5.10,140/663] gma500: clean up error handling in init [5.10,141/663] drm/fb-helper: Add missed unlocks in setcmap_legacy() [5.10,142/663] drm/panel: mantix: Tweak init sequence [5.10,144/663] crypto: sun4i-ss - linearize buffers content must be kept [5.10,145/663] crypto: sun4i-ss - fix kmap usage [5.10,148/663] media: allegro: Fix use after free on error [5.10,149/663] kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state() [5.10,151/663] drm: rcar-du: Fix crash when using LVDS1 clock for CRTC [5.10,153/663] drm: rcar-du: Fix leak of CMM platform device reference [5.10,154/663] drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition [5.10,156/663] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 [5.10,158/663] drm/fourcc: fix Amlogic format modifier masks [5.10,159/663] media: ipu3-cio2: Build only for x86 [5.10,160/663] media: i2c: ov5670: Fix PIXEL_RATE minimum value [5.10,162/663] media: imx: Fix csc/scaler unregister [5.10,163/663] media: mtk-vcodec: fix error return code in vdec_vp9_decode() [5.10,164/663] media: camss: missing error code in msm_video_register() [5.10,165/663] media: vsp1: Fix an error handling path in the probe function [5.10,167/663] media: media/pci: Fix memleak in empress_init [5.10,169/663] media: aspeed: fix error return code in aspeed_video_setup_video() [5.10,170/663] ASoC: cs42l56: fix up error handling in probe [5.10,172/663] evm: Fix memleak in init_desc [5.10,174/663] sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue [5.10,175/663] drm/sun4i: tcon: fix inverted DCLK polarity [5.10,178/663] media: ti-vpe: cal: fix write to unallocated memory [5.10,179/663] MIPS: properly stop .eh_frame generation [5.10,181/663] drm/tegra: Fix reference leak when pm_runtime_get_sync() fails [5.10,182/663] drm/amdgpu: toggle on DF Cstate after finishing xgmi injection [5.10,183/663] bsg: free the request before return error code [5.10,184/663] macintosh/adb-iop: Use big-endian autopoll mask [5.10,186/663] drm/amd/display: Fix HDMI deep color output for DCE 6-11. [5.10,190/663] media: atomisp: Fix a buffer overflow in debug code [5.10,194/663] media: pxa_camera: declare variable when DEBUG is defined [5.10,196/663] sched/eas: Dont update misfit status if the task is pinned [5.10,197/663] f2fs: compress: fix potential deadlock [5.10,204/663] crypto: talitos - Fix ctr(aes) on SEC1 [5.10,206/663] mm: proc: Invalidate TLB after clearing soft-dirty page state [5.10,207/663] ata: ahci_brcm: Add back regulators management [5.10,209/663] ASoC: codecs: add missing max_register in regmap config [5.10,210/663] mtd: parsers: afs: Fix freeing the part name memory in failure [5.10,214/663] ASoC: qcom: Fix typo error in HDMI regmap config callbacks [5.10,219/663] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A5E [5.10,220/663] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A3E [5.10,222/663] ASoC: qcom: lpass: Fix i2s ctl register bit map [5.10,224/663] ASoC: SOF: debug: Fix a potential issue on string buffer termination [5.10,226/663] btrfs: fix double accounting of ordered extent for subpage case in btrfs_invalidapge [5.10,228/663] s390/zcrypt: return EIO when msg retry limit reached [5.10,229/663] drm/vc4: hdmi: Move hdmi reset to bind [5.10,230/663] drm/vc4: hdmi: Fix register offset with longer CEC messages [5.10,231/663] drm/vc4: hdmi: Fix up CEC registers [5.10,232/663] drm/vc4: hdmi: Restore cec physical address on reconnect [5.10,234/663] drm/vc4: hdmi: Update the CEC clock divider on HSM rate change [5.10,235/663] drm/lima: fix reference leak in lima_pm_busy [5.10,236/663] drm/dp_mst: Dont cache EDIDs for physical ports [5.10,240/663] nvmet-tcp: fix receive data digest calculation for multiple h2cdata PDUs [5.10,242/663] nvme-multipath: set nr_zones for zoned namespaces [5.10,243/663] nvmet: remove extra variable in identify ns [5.10,247/663] ima: Free IMA measurement buffer after kexec syscall [5.10,248/663] ASoC: simple-card-utils: Fix device module clock [5.10,250/663] jffs2: fix use after free in jffs2_sum_write_data() [5.10,252/663] ubifs: replay: Fix high stack usage, again [5.10,257/663] capabilities: Dont allow writing ambiguous v3 file capabilities [5.10,258/663] HSI: Fix PM usage counter unbalance in ssi_hw_init [5.10,261/663] clk: meson: clk-pll: make "ret" a signed integer [5.10,264/663] regulator: qcom-rpmh-regulator: add pm8009-1 chip revision [5.10,265/663] arm64: dts: qcom: qrb5165-rb5: fix pm8009 regulators [5.10,266/663] quota: Fix memory leak when handling corrupted quota file [5.10,267/663] i2c: iproc: handle only slave interrupts which are enabled [5.10,270/663] spi: cadence-quadspi: Abort read if dummy cycles required are too many [5.10,272/663] clk: renesas: r8a779a0: Remove non-existent S2 clock [5.10,273/663] clk: renesas: r8a779a0: Fix parent of CBFUSA clock [5.10,276/663] dmaengine: fsldma: Fix a resource leak in the remove function [5.10,278/663] dmaengine: owl-dma: Fix a resource leak in the remove function [5.10,279/663] dmaengine: hsu: disable spurious interrupt [5.10,280/663] mfd: bd9571mwv: Use devm_mfd_add_devices() [5.10,281/663] power: supply: cpcap-charger: Fix missing power_supply_put() [5.10,283/663] power: supply: cpcap-charger: Fix power_supply_put on null battery pointer [5.10,285/663] of/fdt: Make sure no-map does not remove already reserved regions [5.10,287/663] RDMA/rtrs-srv: Release lock before call into close_sess [5.10,289/663] RDMA/rtrs-clt: Set mininum limit when create QP [5.10,290/663] RDMA/rtrs: Call kobject_put in the failure path [5.10,293/663] RDMA/rtrs-srv: Init wr_cnt as 1 [5.10,294/663] power: reset: at91-sama5d2_shdwc: fix wkupdbc mask [5.10,295/663] rtc: s5m: select REGMAP_I2C [5.10,298/663] clocksource/drivers/ixp4xx: Select TIMER_OF when needed [5.10,299/663] clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined [5.10,300/663] spi: imx: Dont print error on -EPROBEDEFER [5.10,301/663] RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation [5.10,302/663] IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex [5.10,303/663] clk: sunxi-ng: h6: Fix clock divider range on some clocks [5.10,307/663] watch_queue: Drop references to /dev/watch_queue [5.10,310/663] spi: atmel: Put allocated master before return [5.10,313/663] power: supply: smb347-charger: Fix interrupt usage if interrupt is unavailable [5.10,317/663] auxdisplay: ht16k33: Fix refresh rate handling [5.10,321/663] scsi: lpfc: Fix ancient double free [5.10,324/663] IB/umad: Return EPOLLERR in case of when device disassociated [5.10,326/663] powerpc/47x: Disable 256k page size [5.10,328/663] powerpc/time: Enable sched clock for irqtime [5.10,330/663] mmc: sdhci-sprd: Fix some resource leaks in the remove function [5.10,331/663] mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe [5.10,334/663] i2c: qcom-geni: Store DMA mapping data in geni_i2c_dev struct [5.10,336/663] amba: Fix resource leak for drivers without .remove [5.10,340/663] IB/cm: Avoid a loop when device has 255 ports [5.10,344/663] perf vendor events arm64: Fix Ampere eMag event typo [5.10,345/663] RDMA/rxe: Fix coding error in rxe_recv.c [5.10,349/663] mfd: altera-sysmgr: Fix physical address storing more [5.10,354/663] kunit: tool: fix unit test cleanup handling [5.10,356/663] RDMA/hns: Fixed wrong judgments in the goto branch [5.10,359/663] RDMA/hns: Disable RQ inline by default [5.10,361/663] spi: pxa2xx: Fix the controller numbering for Wildcat Point [5.10,362/663] powerpc/uaccess: Avoid might_fault() when user access is enabled [5.10,363/663] powerpc/kuap: Restore AMR after replaying soft interrupts [5.10,364/663] regulator: qcom-rpmh: fix pm8009 ldo7 [5.10,365/663] clk: aspeed: Fix APLL calculate formula from ast2600-A2 [5.10,367/663] perf symbols: Use (long) for iterator for bfd symbols [5.10,369/663] spi: dw: Avoid stack content exposure [5.10,370/663] spi: Skip zero-length transfers in spi_transfer_one_message() [5.10,373/663] nfsd: register pernet ops last, unregister first [5.10,374/663] svcrdma: Hold private mutex while invoking rdma_accept() [5.10,376/663] RDMA/hns: Fixes missing error code of CMDQ [5.10,377/663] RDMA/ucma: Fix use-after-free bug in ucma_create_uevent [5.10,378/663] RDMA/rtrs-srv: Fix stack-out-of-bounds [5.10,380/663] RDMA/rtrs-srv: fix memory leak by missing kobject free [5.10,381/663] RDMA/rtrs-srv-sysfs: fix missing put_device [5.10,382/663] RDMA/rtrs-srv: Do not pass a valid pointer to PTR_ERR() [5.10,383/663] Input: sur40 - fix an error code in sur40_probe() [5.10,388/663] perf test: Fix unaligned access in sample parsing test [5.10,389/663] Input: elo - fix an error code in elo_connect() [5.10,391/663] sparc: fix led.c driver when PROC_FS is not enabled [5.10,393/663] ARM: 9065/1: OABI compat: fix build when EPOLL is not enabled [5.10,394/663] misc: eeprom_93xx46: Fix module alias to enable module autoprobe [5.10,397/663] misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tre... [5.10,398/663] PCI: rcar: Always allocate MSI addresses in 32bit space [5.10,399/663] soundwire: debugfs: use controller id instead of link_id [5.10,401/663] pwm: rockchip: Enable APB clock during register access while probing [5.10,403/663] pwm: rockchip: Eliminate potential race condition when probing [5.10,407/663] mei: hbm: call mei_set_devstate() on hbm stop response [5.10,408/663] drm/msm: Fix MSM_INFO_GET_IOVA with carveout [5.10,410/663] drm/msm/mdp5: Fix wait-for-commit for cmd panels [5.10,413/663] drm/msm/dp: trigger unplug event in msm_dp_display_disable [5.10,414/663] vfio/iommu_type1: Populate full dirty when detach non-pinned group [5.10,417/663] ext4: fix potential htree index checksum corruption [5.10,418/663] phy: USB_LGM_PHY should depend on X86 [5.10,419/663] coresight: etm4x: Skip accessing TRCPDCR in save/restore [5.10,421/663] nvmem: core: skip child nodes not matching binding [5.10,422/663] soundwire: bus: use sdw_update_no_pm when initializing a device [5.10,423/663] soundwire: bus: use sdw_write_no_pm when setting the bus scale registers [5.10,424/663] soundwire: export sdw_write/read_no_pm functions [5.10,428/663] regmap: sdw: use _no_pm functions in regmap_read/write [5.10,430/663] mailbox: sprd: correct definition of SPRD_OUTBOX_FIFO_FULL [5.10,433/663] PCI: cadence: Fix DMA range mapping early return error [5.10,435/663] i40e: Add zero-initialization of AQ command structures [5.10,436/663] i40e: Fix overwriting flow control settings during driver loading [5.10,437/663] i40e: Fix addition of RX filters after enabling FW LLDP agent [5.10,441/663] i40e: Fix add TC filter for IPv6 [5.10,442/663] octeontx2-af: Fix an off by one in rvu_dbg_qsize_write() [5.10,445/663] ice: report correct max number of TCs [5.10,446/663] ice: Account for port VLAN in VF max packet size calculation [5.10,450/663] net/mlx4_core: Add missed mlx4_free_cmd_mailbox() [5.10,451/663] PCI: rockchip: Make ep-gpios DT property optional [5.10,453/663] wireguard: device: do not generate ICMP for non-IP packets [5.10,454/663] wireguard: kconfig: use arm chacha even with no neon [5.10,458/663] mm/memory.c: fix potential pte_unmap_unlock pte error [5.10,459/663] mm/hugetlb: fix potential double free in hugetlb_register_node() error path [5.10,466/663] arm64: Add missing ISB after invalidating TLB in __primary_switch [5.10,475/663] scsi: sd: sd_zbc: Dont pass GFP_NOIO to kvcalloc [5.10,476/663] block: reopen the device in blkdev_reread_part [5.10,477/663] ide/falconide: Fix module unload [5.10,481/663] ACPI: property: Fix fwnode string properties matching [5.10,482/663] ACPI: configfs: add missing check after configfs_register_default_group() [5.10,484/663] HID: logitech-dj: add support for keyboard events in eQUAD step 4 Gaming [5.10,487/663] Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X\|S [5.10,491/663] USB: serial: option: update interface mapping for ZTE P685M [5.10,492/663] usb: musb: Fix runtime PM race in musb_queue_resume_work [5.10,493/663] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 [5.10,497/663] USB: serial: mos7840: fix error code in mos7840_write() [5.10,498/663] USB: serial: mos7720: fix error code in mos7720_write() [5.10,499/663] phy: lantiq: rcu-usb2: wait after clock enable [5.10,500/663] ALSA: fireface: fix to parse sync status register of latter protocol [5.10,502/663] ALSA: hda/hdmi: Drop bogus check at closing a stream [5.10,503/663] ALSA: hda/realtek: modify EAPD in the ALC886 [5.10,507/663] MIPS: VDSO: Use CLANG_FLAGS instead of filtering out --target= [5.10,510/663] bcache: Give btree_io_wq correct semantics again [5.10,512/663] Revert "drm/amd/display: Update NV1x SR latency values" [5.10,514/663] drm/amd/display: Remove Assert from dcn10_get_dig_frontend [5.10,517/663] drm/amdgpu: Set reference clock to 100Mhz on Renoir (v2) [5.10,521/663] drm/panel: kd35t133: allow using non-continuous dsi clock [5.10,522/663] drm/rockchip: Require the YTR modifier for AFBC [5.10,523/663] ASoC: siu: Fix build error by a wrong const prefix [5.10,524/663] selinux: fix inconsistency between inode_getxattr and inode_listsecurity [5.10,530/663] KEYS: trusted: Reserve TPM for seal and unseal operations [5.10,532/663] btrfs: do not warn if we cant find the reloc root when looking up backref [5.10,536/663] btrfs: splice remaining dirty_bgs onto the transaction dirty bg list [5.10,539/663] btrfs: fix extent buffer leak on failure to copy root [5.10,542/663] crypto: arm64/sha - add missing module aliases [5.10,543/663] crypto: aesni - prevent misaligned buffers on the stack [5.10,546/663] crypto: sun4i-ss - IV register does not work on A10 and A13 [5.10,547/663] crypto: sun4i-ss - handle BigEndian for cipher [5.10,548/663] crypto: sun4i-ss - initialize need_fallback [5.10,549/663] soc: samsung: exynos-asv: dont defer early on not-supported SoCs [5.10,551/663] seccomp: Add missing return in non-void function [5.10,552/663] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) [5.10,553/663] misc: rtsx: init of rts522a add OCP power off when no card is present [5.10,557/663] arm64: dts: agilex: fix phy interface bit shift for gmac1 and gmac2 [5.10,558/663] staging/mt7621-dma: mtk-hsdma.c->hsdma-mt7621.c [5.10,559/663] staging: gdm724x: Fix DMA from stack [5.10,560/663] staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table [5.10,562/663] media: i2c: max9286: fix access to unallocated memory [5.10,563/663] media: ir_toy: add another IR Droid device [5.10,565/663] media: marvell-ccic: power up the device on mclk enable [5.10,566/663] media: smipcie: fix interrupt handling and IR timeout [5.10,570/663] x86/entry: Fix instrumentation annotation [5.10,573/663] rcu/nocb: Perform deferred wake up before last idles need_resched() check [5.10,577/663] kprobes: Fix to delay the kprobes jump optimization [5.10,578/663] arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55 [5.10,580/663] arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails [5.10,581/663] arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing [5.10,582/663] arm64 module: set plt* section addresses to 0x0 [5.10,583/663] arm64: spectre: Prevent lockdep splat on v4 mitigation enable path [5.10,585/663] watchdog: qcom: Remove incorrect usage of QCOM_WDT_ENABLE_IRQ [5.10,586/663] watchdog: mei_wdt: request stop on unregister [5.10,587/663] coresight: etm4x: Handle accesses to TRCSTALLCTLR [5.10,592/663] mtd: spi-nor: hisi-sfc: Put child node np on error path [5.10,593/663] fs/affs: release old buffer head on error path [5.10,594/663] seq_file: document how per-entry resources are managed. [5.10,595/663] x86: fix seq_file iteration for pat/memtype.c [5.10,597/663] mm: memcontrol: fix get_active_memcg return value [5.10,599/663] hugetlb: fix copy_huge_page_from_user contig page struct assumption [5.10,602/663] KVM: nSVM: fix running nested guests when npt=0 [5.10,605/663] mmc: sdhci-esdhc-imx: fix kernel panic when remove module [5.10,606/663] mmc: sdhci-pci-o2micro: Bug fix for SDR104 HW tuning failure [5.10,609/663] powerpc/32s: Add missing call to kuep_lock on syscall entry [5.10,610/663] spmi: spmi-pmic-arb: Fix hw_irq overflow [5.10,611/663] mei: fix transfer over dma with extended header [5.10,612/663] mei: me: emmitsburg workstation DID [5.10,618/663] exfat: fix shift-out-of-bounds in exfat_fill_super() [5.10,619/663] zonefs: Fix file size of zones in full condition [5.10,621/663] thermal: cpufreq_cooling: freq_qos_update_request() returns < 0 on error [5.10,622/663] cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks [5.10,624/663] cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available [5.10,631/663] f2fs: fix out-of-repair __setattr_copy() [5.10,633/663] f2fs: flush data when enabling checkpoint back [5.10,634/663] sparc32: fix a user-triggerable oops in clear_user() [5.10,635/663] spi: fsl: invert spisel_boot signal on MPC8309 [5.10,636/663] spi: spi-synquacer: fix set_cs handling [5.10,638/663] gfs2: Dont skip dlm unlock if glock has an lvb [5.10,640/663] gfs2: Recursive gfs2_quota_hold in gfs2_iomap_end [5.10,641/663] dm: fix deadlock when swapping to encrypted device [5.10,643/663] dm table: fix DAX iterate_devices based device capability checks [5.10,644/663] dm table: fix zoned iterate_devices based device capability checks [5.10,645/663] dm writecache: fix performance degradation in ssd mode [5.10,646/663] dm writecache: return the exact table values that were set [5.10,647/663] dm writecache: fix writing beyond end of underlying device when shrinking [5.10,648/663] dm era: Recover committed writeset after crash [5.10,650/663] dm era: Verify the data block size hasnt changed [5.10,651/663] dm era: Fix bitset memory leaks [5.10,652/663] dm era: Use correct value size in equality function of writeset tree [5.10,654/663] dm era: only resize metadata in preresume [5.10,655/663] drm/i915: Reject 446-480MHz HDMI clock on GLK [5.10,656/663] kgdb: fix to kill breakpoints on initmem after boot [5.10,657/663] ipv6: silence compilation warning for non-IPV6 builds [5.10,658/663] net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending [5.10,659/663] wireguard: selftests: test multiple parallel streams [5.10,660/663] wireguard: queueing: get rid of per-peer ring buffers [5.10,661/663] net: sched: fix police ext initialization [5.10,662/663] net: qrtr: Fix memory leak in qrtr_tun_open

Commit Message

Greg Kroah-Hartman March 1, 2021, 4:06 p.m. UTC

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ce814ad4bb52bfc7c0472e6da0aa742ab88f4361 ]

The "channel" is added to the "dev->channels" but then if
v4l2_m2m_ctx_init() fails then we free "channel" but it's still on the
list so it could lead to a use after free.  Let's not add it to the
list until after v4l2_m2m_ctx_init() succeeds.

Fixes: cc62c74749a3 ("media: allegro: add missed checks in allegro_open()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/allegro-dvt/allegro-core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff mbox series

Patch

diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c
index 9f718f43282bc..640451134072b 100644
--- a/drivers/staging/media/allegro-dvt/allegro-core.c
+++ b/drivers/staging/media/allegro-dvt/allegro-core.c
@@ -2483,8 +2483,6 @@  static int allegro_open(struct file *file)
 	INIT_LIST_HEAD(&channel->buffers_reference);
 	INIT_LIST_HEAD(&channel->buffers_intermediate);
 
-	list_add(&channel->list, &dev->channels);
-
 	channel->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, channel,
 						allegro_queue_init);
 
@@ -2493,6 +2491,7 @@  static int allegro_open(struct file *file)
 		goto error;
 	}
 
+	list_add(&channel->list, &dev->channels);
 	file->private_data = &channel->fh;
 	v4l2_fh_add(&channel->fh);