Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/drivers/misc
History
Exact
Zhenghang Xiao 07ebe87915 misc: fastrpc: fix use-after-free race in fastrpc_map_create 
fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The
caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero)
on this unprotected pointer. A concurrent MEM_UNMAP can free the map
between the lock release and the kref operation, resulting in a
use-after-free on the freed slab object.

Restore the take_ref parameter to fastrpc_map_lookup so the reference
is acquired atomically under fl->lock before the pointer is exposed to
the caller.

Fixes: 10df039834 ("misc: fastrpc: Skip reference for DMA handles")
Cc: stable@vger.kernel.org
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204528.116920-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-05 17:20:51 +02:00
..
altera-stapl Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
amd-sbi misc: amd-sbi: Add device tree mapping for AMD SBRMI devices 2026-04-02 16:17:29 +02:00
bcm-vk Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
c2port Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cardreader Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cb710 misc: cb710: Fix a NULL vs IS_ERR() check in probe() 2025-11-26 15:09:34 +01:00
eeprom Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
genwqe Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
ibmasm ibmasm: fix heap over-read in ibmasm_send_i2o_message() 2026-04-02 16:31:02 +02:00
keba Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
lis3lv02d lis3lv02d: Omit IRQF_ONESHOT if no threaded handler is provided 2026-04-01 10:19:43 +02:00
lkdtm lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test 2026-03-31 16:53:47 -07:00
mchp_pci1xxxx Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
mei mei: me: add nova lake point H DID 2026-04-06 11:40:38 +02:00
ocxl Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pvpanic
rp1 misc: rp1: Send IACK on IRQ activate to fix kdump/kexec 2026-05-22 12:19:02 +02:00
sgi-gru mm: rename zap_vma_ptes() to zap_special_vma_range() 2026-04-05 13:53:15 -07:00
sgi-xp Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
uacce Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmw_vmci misc: vmw_vmci: Fix spelling mistakes in comments 2026-04-02 17:06:00 +02:00
ad525x_dpot-i2c.c
ad525x_dpot-spi.c
ad525x_dpot.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ad525x_dpot.h
apds990x.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
apds9802als.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
atmel-ssc.c
bh1770glc.c misc: bh1770glc: use pm_runtime_resume_and_get() in power_state_store 2025-11-26 15:09:37 +01:00
cs5535-mfgpt.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ds1682.c sysfs: treewide: switch back to bin_attribute::read()/write() 2025-06-17 10:44:13 +02:00
dummy-irq.c
dw-xdata-pcie.c dw-xdata: Use str_write_read() in dw_xdata_start() and dw_xdata_perf() 2025-09-06 15:59:39 +02:00
enclosure.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fastrpc.c misc: fastrpc: fix use-after-free race in fastrpc_map_create 2026-06-05 17:20:51 +02:00
gehc-achc.c
hi6421v600-irq.c misc: Use dev_fwnode() 2025-06-24 16:45:08 +01:00
hisi_hikey_usb.c misc: hisi_hikey_usb: Use str_enabled_disabled() in hub_power_ctrl() 2025-08-19 12:37:15 +02:00
hmc6352.c
hpilo.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpilo.h
ibmvmc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ibmvmc.h
ics932s401.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
isl29003.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
isl29020.c
Kconfig misc: ti_fpc202: Support special-purpose GPIO lines with LED features 2026-04-02 16:29:27 +02:00
kgdbts.c Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
lan966x_pci.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
lan966x_pci.dtso
lattice-ecp3-config.c
Makefile char: misc: Move drivers/misc/misc_minor_kunit.c to drivers/char/ 2025-08-19 12:41:17 +02:00
mrvl_cn10k_dpi.c
nsm.c
ntsync.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
open-dice.c misc: open-dice: replace deprecated mmap hook with mmap_prepare 2026-04-05 13:53:43 -07:00
pch_phub.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pci_endpoint_test.c selftests: pci_endpoint: Skip BAR subrange test on -ENOSPC 2026-04-08 14:41:39 -05:00
phantom.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
qcom-coincell.c
rpmb-core.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smpro-errmon.c
smpro-misc.c
sram-exec.c
sram.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sram.h
ti_fpc202.c misc: ti_fpc202: Support special-purpose GPIO lines with LED features 2026-04-02 16:29:27 +02:00
tifm_7xx1.c
tifm_core.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tps6594-esm.c
tps6594-pfsm.c misc: tps6594-pfsm: Add TI TPS652G1 PMIC PFSM 2025-07-10 09:58:06 +01:00
tsl2550.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vcpu_stall_detector.c
vmw_balloon.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xilinx_sdfec.c
xilinx_tmr_inject.c
xilinx_tmr_manager.c