Mathias Krause a5ce7ee5fc misc: fastrpc: avoid double fput() on failed usercopy ... [ Upstream commit 46963e2e06 ] If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us with none. Calling dma_buf_put() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free. Simply avoid calling dma_buf_put() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid. Fixes: 6cffd79504 ("misc: fastrpc: Add support for dmabuf exporter") Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Mathias Krause <minipli@grsecurity.net> Link: https://lore.kernel.org/r/20220127130218.809261-1-minipli@grsecurity.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-02-16 12:54:24 +01:00
..
altera-stapl
c2port
cardreader	misc: alcor_pci: fix inverted branch condition	2021-07-20 16:05:50 +02:00
cb710	cb710: avoid NULL pointer subtraction	2021-10-20 11:45:00 +02:00
cxl
echo
eeprom	misc: eeprom: at24: Always append device id even if label property is set.	2021-07-28 14:35:46 +02:00
genwqe
habanalabs	habanalabs/gaudi: fix LBW RR configuration	2021-10-09 14:40:56 +02:00
ibmasm	misc/libmasm/module: Fix two use after free in ibmasm_init_one	2021-07-20 16:05:38 +02:00
lis3lv02d
lkdtm	lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()	2022-01-27 10:53:43 +01:00
mei	mei: me: add Ice Lake-N device id.	2021-10-20 11:44:59 +02:00
ocxl
sgi-gru
sgi-xp
ti-st
uacce
vmw_vmci	VMCI: fix NULL pointer dereference when unmapping queue pair	2021-09-18 13:40:09 +02:00
ad525x_dpot-i2c.c
ad525x_dpot-spi.c
ad525x_dpot.c
ad525x_dpot.h
apds990x.c
apds9802als.c
atmel_tclib.c
atmel-ssc.c
bh1770glc.c
cs5535-mfgpt.c
ds1682.c
dummy-irq.c
enclosure.c
fastrpc.c	misc: fastrpc: avoid double fput() on failed usercopy	2022-02-16 12:54:24 +01:00
hisi_hikey_usb.c
hmc6352.c
hpilo.c
hpilo.h
ibmvmc.c
ibmvmc.h
ics932s401.c
isl29003.c
isl29020.c
Kconfig
kgdbts.c
lattice-ecp3-config.c	misc: lattice-ecp3-config: Fix task hung when firmware load failed	2022-01-27 10:54:08 +01:00
Makefile
pch_phub.c
pci_endpoint_test.c
phantom.c
pti.c
pvpanic.c
qcom-coincell.c
sram-exec.c
sram.c	treewide: Change list_sort to use const pointers	2021-09-30 10:11:04 +02:00
sram.h
tifm_7xx1.c
tifm_core.c
tsl2550.c
vmw_balloon.c
xilinx_sdfec.c