Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/drivers
History
Yavuz, Tuba 628d00a9e1 USB: gadget: f_midi: fixing a possible double-free in f_midi 
It looks like there is a possibility of a double-free vulnerability on an
error path of the f_midi_set_alt function in the f_midi driver. If the
path is feasible then free_ep_req gets called twice:

         req->complete = f_midi_complete;
         err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC);
            => ...
             usb_gadget_giveback_request
               =>
                 f_midi_complete (CALLBACK)
                   (inside f_midi_complete, for various cases of status)
                   free_ep_req(ep, req); // first kfree
         if (err) {
                 ERROR(midi, "%s: couldn't enqueue request: %d\n",
                             midi->out_ep->name, err);
                 free_ep_req(midi->out_ep, req); // second kfree
                 return err;
         }

The double-free possibility was introduced with commit ad0d1a058eac
("usb: gadget: f_midi: fix leak on failed to enqueue out requests").

Found by MOXCAFE tool.

Signed-off-by: Tuba Yavuz <tuba@ece.ufl.edu>
Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests")
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: I93342475b7e72ae44fed7d7c8f92d5f8dbf53c8a
 		2019-12-07 19:20:29 +01:00
..
accessibility
…
acpi ACPI: APEI / ERST: Fix missing error handling in erst_reader() 2019-07-27 21:46:19 +02:00
amba
…
android ANDROID: binder: synchronize_rcu() when using POLLFREE. 2019-10-19 23:14:00 +02:00
ata treewide: Fix typo in Documentation/DocBook 2019-07-27 22:10:20 +02:00
atm
…
auxdisplay
…
base firmware_class: Tie exporting caching routines with CONFIG_CACHE_FW 2019-07-27 22:11:15 +02:00
battery Import T813XXS2BRC2 kernel source changes 2018-05-26 00:39:42 +02:00
battery_v2 Import latest Samsung release 2017-04-18 03:43:52 +02:00
bcma
…
bif
…
block Revert "block/loop: Use global lock for ioctl() operation." 2019-07-27 22:10:39 +02:00
bluetooth bluetooth: Define proper kernel messages 2019-07-27 22:08:39 +02:00
bus
…
cdrom BACKPORT: block: add blk_rq_set_block_pc() 2017-04-22 23:03:01 +02:00
char diag: Mark Buffer as NULL after freeing 2019-09-28 20:28:33 +02:00
clk ANDROID: fix uninitilized variable 2019-07-27 22:10:15 +02:00
clocksource Merge tag 'LA.BR.1.3.6-05410-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2018-02-06 13:11:45 +01:00
connector
…
coresight coresight: tmc: Fix use after free issue with tmc read 2017-07-30 10:34:00 -07:00
cpufreq ANDROID: fix uninitilized variable 2019-07-27 22:10:15 +02:00
cpuidle lpm-levels: Remove kfree for memory allocated with devm_kzalloc 2019-07-27 22:08:40 +02:00
crypto msm: ice: check for crypto engine availability 2019-07-27 22:08:47 +02:00
dca
…
debug Import latest Samsung release 2017-04-18 03:43:52 +02:00
debug_32 Import latest Samsung release 2017-04-18 03:43:52 +02:00
devfreq dev_freq: devfreq_spdm: add null terminator to prevent OOB access 2019-07-27 21:50:47 +02:00
dio
…
dma Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
edac This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
eisa
…
esoc
…
extcon Import latest Samsung release 2017-04-18 03:43:52 +02:00
fingerprint drivers: fingerprint: Kill FEATURE_SPI_WAKELOCK 2017-04-19 17:02:36 +02:00
firewire This is the 3.10.95 stable release 2017-04-18 17:14:54 +02:00
firmware Import T813XXU2BQD1 kernel source changes 2017-04-22 16:30:03 +02:00
gpio gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input 2019-08-15 21:02:28 +02:00
gpu msm: kgsl: Fix race condition between cmdbatch and context destroy 2019-10-27 19:33:27 +01:00
hid HID: i2c-hid: Do not free buffers in i2c_hid_stop() 2019-07-27 22:11:08 +02:00
hsi
…
hv Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors 2016-06-07 10:42:52 +02:00
hwmon hwmon: Cleanup kmesg when probing for VADC 2019-08-13 03:29:23 +02:00
hwspinlock
…
i2c i2c: dev: prevent adapter retries and timeout being set as minus value 2019-07-27 21:53:34 +02:00
ide UPSTREAM: block: disable entropy contributions for nonrot devices 2019-07-27 21:47:56 +02:00
idle
…
iio iio: Fix scan mask selection 2019-08-15 21:02:28 +02:00
infiniband IB/qib: fix mcast detach when qp not attached 2016-03-03 15:06:24 -08:00
input touchscreen: sec_ts: Fix array OOB issues in the sec_ts touch driver. 2019-09-11 19:44:53 +02:00
iommu iommu/amd: Finish TLB flush in amd_iommu_unmap() 2019-07-27 21:44:19 +02:00
ipack
…
irqchip Import latest Samsung release 2017-04-18 03:43:52 +02:00
isdn net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
leds Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD 2017-04-18 12:11:50 +02:00
lguest Import latest Samsung release 2017-04-18 03:43:52 +02:00
macintosh
…
mailbox
…
md dm kcopyd: avoid softlockup in run_complete_job 2019-07-27 21:51:38 +02:00
media msm: vidc: Add checks to avoid OOB access(refined) 2019-11-26 00:07:09 +01:00
memory
…
memstick
…
message
…
mfd mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode 2019-07-27 21:44:34 +02:00
misc qseecom: check invalid handle for app loaded query request 2019-12-06 19:35:20 +01:00
mmc mmc: mmc: fix switch timeout issue caused by jiffies precision 2019-07-27 22:08:58 +02:00
motor Import latest Samsung release 2017-04-18 03:43:52 +02:00
mtd UPSTREAM: block: disable entropy contributions for nonrot devices 2019-07-27 21:47:56 +02:00
muic drivers/muic: Fix '"WRITE" redefined' error after CVE-2019-2001 fix 2019-07-27 22:11:01 +02:00
net qcacld-2.0: Fix buffer overflow in fill_ieee80211_hdr_data 2019-12-07 19:19:43 +01:00
nfc Import latest Samsung release 2017-04-18 03:43:52 +02:00
ntb
…
nubus
…
of of: fdt: add missing allocation-failure check 2019-07-27 21:44:47 +02:00
oprofile
…
parisc parisc iommu: fix panic due to trying to allocate too large region 2016-01-28 21:49:36 -08:00
parport
…
pci PCI / PM: Force devices to D0 in pci_pm_thaw_noirq() 2019-07-27 21:46:19 +02:00
pcmcia
…
phy
…
pinctrl pinctrl: Really force states during suspend/resume 2019-07-27 21:49:40 +02:00
platform msm: sps: Update debug message format specifier 2019-07-27 22:11:32 +02:00
pnp asmlinkage, pnp: Make variables used from assembler code visible 2016-06-07 10:42:53 +02:00
power ANDROID: fix uninitilized variable 2019-07-27 22:10:15 +02:00
pps
…
ps3
…
ptp
…
pwm
…
rapidio
…
regulator regulator: core: Use the power efficient workqueue for delayed powerdown 2019-07-27 22:11:03 +02:00
remoteproc remoteproc: avoid stack overflow in debugfs file 2016-02-19 14:22:37 -08:00
reset
…
rpmsg
…
rtc rtc: ensure rtc_set_alarm fails when alarms are not supported 2019-07-27 22:10:53 +02:00
s390 UPSTREAM: block: disable entropy contributions for nonrot devices 2019-07-27 21:47:56 +02:00
sbus
…
scsi treewide: Fix typo in Documentation/DocBook 2019-07-27 22:10:20 +02:00
sensorhub Import T713XXU2BQD3 kernel source changes 2017-07-01 12:51:07 +02:00
sensors Import latest Samsung release 2017-04-18 03:43:52 +02:00
sfi
…
sh
…
slimbus slim-msm: Synchronize SSR callbacks 2017-05-05 19:20:28 +00:00
sn
…
soc soc: qcom: smem: validate fields of shared structures 2019-07-27 22:11:30 +02:00
soundwire swr-wcd-ctrl: Ensure soundwire banks are always in sync 2016-05-03 04:51:39 -07:00
spi This is the 3.10.97 stable release 2017-04-18 17:17:20 +02:00
spmi Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD 2017-04-18 12:11:50 +02:00
ssb
…
ssbi
…
staging ANDROID: Remove conflicting Samsung options for upstream changes 2019-07-27 22:09:50 +02:00
switch
…
target scsi: target: fix __transport_register_session locking 2019-07-27 21:51:38 +02:00
tc
…
thermal msm: thermal: validate userspace args to prevent buffer overflow. 2019-07-27 22:10:00 +02:00
tty tty: make n_tty_read() always abort if hangup is in progress 2019-07-27 21:49:23 +02:00
uio uio: Fix an Oops on load 2019-07-27 22:06:01 +02:00
usb USB: gadget: f_midi: fixing a possible double-free in f_midi 2019-12-07 19:20:29 +01:00
uwb
…
vfio
…
vhost Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
video fbdev: msm: check the length of the external input buffer properly 2019-07-27 22:11:31 +02:00
virt
…
virtio virtio: fix memory leak of virtio ida cache layers 2016-03-03 15:06:21 -08:00
vlynq
…
vme
…
w1
…
watchdog watchdog: rc32434_wdt: fix ioctl error handling 2016-06-07 10:42:46 +02:00
xen This is the 3.10.96 stable release 2017-04-18 17:16:02 +02:00
zorro
…
Kconfig msm: gud: Remove gud driver 2017-09-08 18:49:12 +00:00
Makefile msm: gud: Remove gud driver 2017-09-08 18:49:12 +00:00