rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity
Files
4ce3fc012a68cffc49ae6e7123eb1ed93c5551c4
android_kernel_samsung_msm8…/drivers
T
History
Jann Horn b859e5f319 tty: Fix ->pgrp locking in tiocspgrp() 
commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.

tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.

To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.

This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.

Fixes: 47f86834bb ("redo locking of tty->pgrp")
CC: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Ib41dbafa06012374b219c7236968733373189ffd
CVE-2020-29661
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
2021-06-14 10:41:33 +02:00
..
accessibility
…
acpi
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
adsp_factory
misc: Import SM-G900H kernel source code
2019-08-02 15:14:10 +02:00
amba
…
ata
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
atm
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
auxdisplay
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
barcode_emul
misc: Import SM-G900H kernel source code
2019-08-02 15:14:10 +02:00
base
mm: Fix incorrect type conversion for size during dma allocation
2019-08-08 12:19:52 +02:00
battery
s3ve3g: switched to sec-battery and qpnp-charger drivers
2020-12-29 21:14:30 +01:00
bcma
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
bif
bif: qpnp-bsi: request BSI interrupts with level high triggering
2015-09-10 10:50:52 +05:30
block
floppy: fix out-of-bounds read in copy_buffer
2020-05-20 09:44:22 +02:00
bluetooth
drivers: bluetooth: Fix direct references to HZ
2019-08-05 14:21:57 +02:00
cdrom
BACKPORT: block: add blk_rq_set_block_pc()
2019-08-06 12:26:35 +02:00
char
diag: Prevent resource leakage of task structure
2021-02-26 09:53:48 +01:00
clk
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
clocksource
sched_clock: Backport high-resolution support
2019-08-05 14:21:53 +02:00
connector
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
coresight
coresight: tmc: Fix the unbalanced lock in tmc_read()
2019-08-08 15:00:19 +02:00
cpufreq
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
cpuidle
misc: Import SM-G900H kernel source code
2019-08-02 15:14:10 +02:00
crypto
crypto: msm: qcrypto: Remove duplicate definition of list_next_entry()
2019-08-06 12:31:22 +02:00
dca
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
devfreq
misc: Import SM-G900H kernel source code
2019-08-02 15:14:10 +02:00
dio
…
dma
Merge remote-tracking branch 'google-common/deprecated/android-3.4' into lineage-16.0
2019-08-06 11:41:21 +02:00
edac
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
eisa
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
extcon
misc: Fix system_rev type mismatch
2019-08-05 09:13:25 +02:00
felica
felica: Allow to compile without CONFIG_SEC_DEBUG
2019-08-09 10:00:22 +02:00
fingerprint
drivers: fingerprint: Kill FEATURE_SPI_WAKELOCK
2019-08-05 09:13:27 +02:00
firewire
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
firmware
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
gpio
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
gpu
msm: kgsl: Remove VM_MAYWRITE flag to restrict mprotect
2021-02-26 09:53:48 +01:00
hid
HID: core: Correctly handle ReportSize being zero
2021-01-03 21:13:43 +01:00
hsi
…
hv
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
hwmon
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
hwspinlock
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
i2c
i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
2020-03-07 14:01:44 +01:00
ide
mm: Backport ZRAM/ZSMALLOC from Google kernel
2019-08-06 08:17:38 +02:00
idle
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
ieee802154
…
infiniband
fs: Limit sys_mount to only request filesystem modules.
2019-08-06 10:44:59 +02:00
input
Input: add safety guards to input_set_keycode()
2020-11-09 11:02:35 +01:00
iommu
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
irda
misc: Import SM-G900H kernel source code
2019-08-02 15:14:10 +02:00
isdn
mISDN: enforce CAP_NET_RAW for raw sockets
2020-05-20 09:44:18 +02:00
leds
leds-qpnp: proper enable flash regulator & general improvements
2020-12-29 21:14:12 +01:00
lguest
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
macintosh
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
mca
…
md
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
media
media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
2020-11-09 11:02:35 +01:00
memstick
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
message
…
mfd
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
misc
sm5502: auto enable/disable 8226_smbbp_otg regulator
2020-05-20 15:00:46 +02:00
mmc
misc: fix some GCC warnings
2019-08-23 13:20:00 +02:00
motor
ss_vibrator: Make sysfs compatible with CMHW
2020-03-07 14:01:44 +01:00
mtd
fs: Limit sys_mount to only request filesystem modules.
2019-08-06 10:44:59 +02:00
net
ath6kl: add some bounds checking
2020-05-20 09:44:21 +02:00
nfc
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
nubus
…
of
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
oprofile
fs: Limit sys_mount to only request filesystem modules.
2019-08-06 10:44:59 +02:00
parisc
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
parport
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
pci
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
pcmcia
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
pinctrl
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
platform
dsp: avtimer: validate payload size before memory copy
2020-08-08 16:42:21 +02:00
pnp
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
power
s3ve3g: switched to sec-battery and qpnp-charger drivers
2020-12-29 21:14:30 +01:00
pps
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
ps3
…
ptp
…
qsc
misc: Import SM-G900H kernel source code
2019-08-02 15:14:10 +02:00
rapidio
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
regulator
misc: fix some GCC warnings
2019-08-23 13:20:00 +02:00
remoteproc
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
rpmsg
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
rtc
rtc: pm8xxx: move device_init_wakeup() before rtc_register
2019-08-06 12:31:33 +02:00
s390
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
sbus
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
scsi
scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
2020-03-07 14:01:44 +01:00
sensorhub
drivers: sensorhub: stm: Kill all the kmsg spam
2019-08-08 15:25:13 +02:00
sensors
drivers: sensors: migrate k2hh.c to alarmtimer interface
2019-08-08 10:42:14 +02:00
sfi
…
sh
…
slimbus
slim-msm: Synchronize SSR callbacks
2019-08-06 11:48:23 +02:00
sn
…
spi
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
spmi
Merge tag 'LA.BF.1.1.3-02310-8x26.0' into lineage-16.0
2019-08-05 11:18:51 +02:00
ssb
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
staging
wlan: Add buf len check in wlan_hdd_cfg80211_testmode
2020-05-21 10:56:02 +02:00
switch
…
target
BACKPORT: block: add blk_rq_set_block_pc()
2019-08-06 12:26:35 +02:00
tc
…
thermal
add hrtimer support to qpnp-sec-charger.c and msm_thermal.c (not fully)
2019-08-06 12:31:35 +02:00
tty
tty: Fix ->pgrp locking in tiocspgrp()
2021-06-14 10:41:33 +02:00
uio
…
usb
USB: core: Fix free-while-in-use bug in the USB S-Glibrary
2020-08-08 16:42:55 +02:00
uwb
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
vhost
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
video
vgacon: Fix a UAF in vgacon_invert_region
2020-08-08 16:41:32 +02:00
virt
…
virtio
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
vlynq
…
w1
Merge remote-tracking branch 'google-common/deprecated/android-3.4' into lineage-16.0
2019-08-06 11:41:21 +02:00
watchdog
Merge tag 'v3.4.113' into lineage-16.0
2019-08-05 14:20:47 +02:00
xen
fs: Limit sys_mount to only request filesystem modules.
2019-08-06 10:44:59 +02:00
zorro
…
Kconfig
msm: gud: Remove gud driver
2019-08-08 12:10:20 +02:00
Makefile
drivers: motor: import vibrator driver from CRJ1 package
2020-03-07 14:01:44 +01:00