Linux kernel vulnerabilities

In the Linux kernel, the drm/i915/hdcp driver has a vulnerability where the bounds check for the data->streams[] array is performed after the buffer overflow has already occurred. The fix moves the check before the write, preventing memory overwrite.

In the Linux kernel, the drm/amdgpu/sdma7.0 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/amdgpu/sdma6.0 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/amdgpu/sdma5.2 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/amdgpu/sdma5.0 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/i915 driver's active_instance function may return a pointer to node->base when node is NULL due to OOM during GFP_ATOMIC allocation. The fix changes the function to return NULL on error.

In the Linux kernel, the drm/i915/bios driver lacked range checking for the panel_type2 field in the LFP Data Block. Helper functions for range checking were added, improving correctness in panel type selection.

In the Linux kernel, the drm/amdgpu/gfx11 driver replaced BUG_ON() with WARN_ON() to avoid crashing the kernel in certain cases.

In the Linux kernel, the drm/amdgpu driver had a lifetime issue with the vm pointer in amdgpu_vm_get_task_info_pasid(). The pointer was used after the lock was released, potentially leading to use-after-unlock. The fix removes the amdgpu_vm_get_vm_from_pasid() function and inlines the code to hold the lock while in use.

In the Linux kernel, the drm/i915/gem driver had a memory leak of the siblings[] array when an error occurred during processing of user extensions after a successful BALANCE/PARALLEL_SUBMIT extension on context creation. The fix addresses this leak.

In the Linux kernel, the drm/i915/gem driver had a NULL pointer dereference when setting an engine slot to I915_ENGINE_CLASS_INVALID and attempting to apply I915_CONTEXT_PARAM_SSEU to the same slot. The fix addresses this issue.

In the Linux kernel, the drm/i915/gt driver had a NULL pointer dereference when sched_engine allocation fails in execlists_create_virtual(). The fix avoids using intel_context_put() before intel_context_init(), preventing the dereference.

In the Linux kernel, the drm/i915/mst driver had an unbounded loop in intel_dp_check_mst_status() servicing interrupts from the sink, potentially getting stuck on stuck sink devices. An upper bound of 32 tries was added.

In the Linux kernel, the drm/gpusvm driver had a device mapping leak on error during page retrieval. The fix publishes dpagemap early so the error path can properly unmap those mappings.

In the Linux kernel, the ttm_pool_backup function in the DRM/TTM module did not account for NULL pages and pages that are backup handles. This caused invalid pointers to be passed to set_pages_array_wb(), leading to a general protection fault (oops) during memory reclaim operations.

In the Linux kernel, the drm/amdgpu driver's amdgpu_acpi_vfct_bios() fetched the VFCT table with acpi_get_table() but never released it, causing a mapping leak. The fix adds acpi_put_table() on all exit paths.

In the Linux kernel, the amdgpu driver has a bug where not all pending fences are force-completed during GPU reset for queues not in MAPPED state. This causes processes waiting on the fence to hang, potentially freezing the system.

In the Linux kernel, the amd/display driver has a bug where the new_stream pointer is not set to NULL after release. A later error can cause a double release and potential use-after-free.

In the Linux kernel, the amd/display driver for DCE8 ASICs has a bug where assigning a stream encoder for a second DisplayPort MST stream may select an analog encoder lacking DP hooks, causing NULL pointer dereference and system crash.

In the Linux kernel, the amdgpu driver has a bug where amdgpu_bo_create_reserved incorrectly increments pin_count on every call even when the BO already exists, leading to memory leaks as pin_count never drops to zero.

In the Linux kernel, the vc4 driver has a bug where the BO cache timer can be rearmed during teardown, leading to use-after-free or resource leaks.

In the Linux kernel, the gpusvm driver has a bug where an MM reference is not released on kvmalloc_array() failure in drm_gpusvm_range_evict, causing a reference leak.

In the Linux kernel, the airspy driver has a bug where buffers are not returned on start_streaming() failure, causing buffer leaks and WARN_ON warnings.

In the Linux kernel, the amlogic-c3 driver has a bug where missing validation of zones_num in AE and AWB config can lead to out-of-bounds access of the zone_weight buffer.

In the Linux kernel, the cedrus driver has a bug where invalid indices in H.264 reference lists can cause out-of-bounds reads of the DPB array. The fix skips such entries.

In the Linux kernel, the chips-media wave5 driver has a bug where a buffer can be returned to userspace before being removed from the ready queue, leading to list corruption and pointer poisoning.

In the Linux kernel, the cx231xx driver had a devres lifetime issue where resources were tied to the USB device instead of the interface, potentially causing memory leaks on driver unbind without physical disconnect.

In the Linux kernel, the cx23885 driver now checks the return value of pci_ioremap_bar() in cx23885_dev_setup(). If ioremap for BAR0 fails, it releases the allocated PCI memory region, decrements the device count, and returns -ENODEV.

In the Linux kernel, the i2c alvium driver fixed a critical pointer access issue in alvium_ctrl_init. The function created several controls and used the returned pointer without checking, which could lead to write access over NULL pointer. The fix adds pointer checks before adding flags.

In the Linux kernel, the mali-c55 driver fixed a possible ERR_PTR dereference in enable_streams. The function media_pad_remote_pad_unique() can return ERR_PTR on error, and the return value was assigned without checking, which could lead to ERR_PTR dereference. Added proper error checking with IS_ERR() before dereferencing and set remote_src to NULL on error.

In the Linux kernel, the meson vdec driver fixed a memory leak in the error path of vdec_open. Previously, when vdec_init_ctrls() failed, the m2m context was not released, causing a resource leak. Added an err_m2m_ctx_release label that calls v4l2_m2m_ctx_release() before releasing the m2m device.

In the Linux kernel, a vulnerability in the msi2500 driver (MSI2500 SDR receiver) causes queued vb2 buffers to leak when start_streaming() fails. Five error paths failed to return buffers to the vb2 framework, triggering WARN_ON and memory leaks. The fix consolidates error handling, ensuring all buffers are returned and the correct error code is propagated.

In the Linux kernel, the nuvoton npcm-video driver fixed memory leaks in probe and remove functions. The npcm_video structure was not freed on error paths or in npcm_video_remove(), and the reserved memory association was not released when npcm_video_setup_video() failed.

In the Linux kernel, the nxp imx8-isi driver added missing v4l2_subdev_cleanup() calls in crossbar and pipe cleanup paths. Initialization functions allocated subdev active state, but it was not freed, causing a memory leak on every rmmod.

In the Linux kernel, the nxp imx8-isi driver fixed potential out-of-bounds issues. The maximum downscaling factor supported by ISI can be up to 16. Added a minimum value constraint before applying the setting to hardware to prevent the process from becoming unresponsive.

In the Linux kernel, the pci dm1105 driver fixed a memory leak by destroying the allocated workqueue in the remove() callback. Previously, the workqueue resources were not freed, causing a memory leak.

In the Linux kernel, the pwc driver (USB camera) has a buffer leak during start_streaming() failure. When the first URB is submitted, its completion handler can move a buffer to fill_buf, and the error path does not free that buffer, leading to a WARN_ON and memory leak.

In the Linux kernel, the pwc driver (USB camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers via vb2_buffer_done(), a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the radio-si476x driver has a reference leak on probe failure. If V4L2 registration succeeds but later steps fail, the v4l2_device is not unregistered, leading to a leak.

In the Linux kernel, the rtl2832 driver (DVB-T tuner) has a use-after-free during device removal. A delayed work can be rescheduled after cancellation, leading to use after memory free.

In the Linux kernel, the rtl2832_sdr driver has a vulnerability causing vb2 buffer leak on start_streaming() failure. If the function returns an error without returning buffers, WARN_ON triggers and queued buffers leak. The issue affects multiple error paths, including subdev, tuner, ADC, buffer and URB allocation failures.

In the Linux kernel, the saa7134 driver (TV card) has a possible memory leak in saa7134_video_init1. Missing return value checks for saa7134_pgtable_alloc() and not freeing memory on vb2_queue_init() error lead to leaks and potential use of uninitialized DMA resources.

In the Linux kernel, the stm32-dcmipp driver (camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers, a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the stm32 dcmi driver (camera) has a notifier leak on probe failure. If notifier registration succeeds but later steps fail, the notifier is not unregistered, leading to a leak.

In the Linux kernel, the sun4i-csi driver (camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers, a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the ti vpe driver has an error code bug for devm_kzalloc(). Using PTR_ERR_OR_ZERO() returns 0 for NULL pointer, masking the memory allocation failure.

In the Linux kernel, in the VPE driver for TI platforms, there is an issue where if the vpe_top resource is missing, vpe_probe() returns -ENODEV after v4l2_device_register() has succeeded. Since probe failures do not call the driver's remove callback, the v4l2 device remains registered on that error path.

In the Linux kernel, in the V4L2 control mechanism (v4l2-ctrls), there is a lack of validation for active L0/L1 reference counts for HEVC slice parameters. The common validation path does not verify these values before driver-specific code consumes them, which can lead to incorrect behavior.

In the Linux kernel, in the v4l2_async_register_subdev_sensor() function, there is an issue with overwriting the subdev owner. The v4l2_async_register_subdev() macro expands to __v4l2_async_register_subdev(sd, THIS_MODULE), but since it is called inside v4l2-fwnode.c, THIS_MODULE resolves to the v4l2-fwnode module rather than the sensor driver module. When v4l2-fwnode is built-in, THIS_MODULE evaluates to NULL, which overwrites the sensor driver's owner with NULL.

In the Linux kernel, in the vivid driver, there is a missing check for vb2_is_busy() when toggling capabilities. The vivid_update_format_cap/out() functions can be called when the capture/output queue is not busy, but for controls that select CROP/COMPOSE/SCALE capability, this check is not performed. This can lead to unexpected results when the format is changed between REQBUFS and STREAMON.