mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-06-03 23:12:57 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31
linux/drivers
History
Sanjay Yadav 28aeaed130 drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() 
In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping
metrics_lock. Since this lock protects the lifetime of oa_config, an
attacker could guess the id and call xe_oa_remove_config_ioctl() with
perfect timing, freeing oa_config before we dereference it, leading to
a potential use-after-free.

Fix this by caching the id in a local variable while holding the lock.

v2: (Matt A)
- Dropped mutex_unlock(&oa->metrics_lock) ordering change from
  xe_oa_remove_config_ioctl()

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6614
Fixes: cdf02fe1a9 ("drm/xe/oa/uapi: Add/remove OA config perf ops")
Cc: <stable@vger.kernel.org> # v6.11+
Suggested-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20251118114859.3379952-2-sanjay.kumar.yadav@intel.com
2025-11-20 11:27:09 +00:00
..
accel
accel/habanalabs: add Infineon version check
2025-09-25 09:14:45 +03:00
accessibility
…
acpi
Merge tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2025-10-07 09:45:07 -07:00
amba
…
android
rust_binder: add Rust Binder driver
2025-09-19 09:40:46 +02:00
ata
Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-10-02 18:18:33 -07:00
atm
…
auxdisplay
…
base
Merge tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2025-10-07 09:39:51 -07:00
bcma
…
block
Merge tag 'block-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2025-10-10 10:37:13 -07:00
bluetooth
Bluetooth: bcsp: receive data only if registered
2025-09-27 11:37:02 -04:00
bus
Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-04 16:26:32 -07:00
cache
…
cdrom
…
cdx
Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-04 16:26:32 -07:00
char
tpm: Prevent local DOS via tpm/tpm0/ppi/*operations
2025-10-10 08:21:45 +03:00
clk
Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
2025-10-07 09:28:37 -07:00
clocksource
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00
comedi
…
connector
…
counter
…
cpufreq
Merge tag 'cpufreq-arm-updates-6.18-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm
2025-10-01 13:59:28 +02:00
cpuidle
cpuidle: Fail cpuidle device registration if there is one already
2025-09-20 13:08:54 +02:00
crypto
Merge tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2025-10-08 09:38:31 -07:00
cxl
Merge branch 'for-6.18/cxl-delay-dport' into cxl-for-next
2025-09-18 14:34:51 -07:00
dax
…
dca
…
devfreq
…
dibs
dibs: Check correct variable in dibs_init()
2025-09-26 15:10:59 -07:00
dio
…
dma
Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
2025-10-06 10:37:06 -07:00
dma-buf
…
dpll
dpll: zl3073x: Allow to configure phase offset averaging factor
2025-09-29 18:57:41 -07:00
edac
Merge tag 'edac_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras
2025-09-30 11:41:03 -07:00
eisa
…
extcon
…
firewire
Merge tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
2025-10-01 12:52:43 -07:00
firmware
Merge tag 'efi-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
2025-10-05 12:08:14 -07:00
fpga
…
fsi
…
fwctl
pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc
2025-09-22 10:33:10 -03:00
gnss
…
gpio
gpio: wcd934x: mark the GPIO controller as sleeping
2025-10-10 09:37:19 +02:00
gpu
drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
2025-11-20 11:27:09 +00:00
greybus
…
hid
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00
hsi
…
hte
…
hv
Drivers: hv: Make CONFIG_HYPERV bool
2025-10-01 00:00:45 +00:00
hwmon
Merge tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
2025-10-01 11:34:12 -07:00
hwspinlock
…
hwtracing
Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-04 16:26:32 -07:00
i2c
Revert "i2c: boardinfo: Annotate code used in init phase only"
2025-10-11 23:57:33 +02:00
i3c
i3c: fix big-endian FIFO transfers
2025-09-29 00:17:22 +02:00
idle
…
iio
Merge tag 'iio-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
2025-09-23 14:15:25 +02:00
infiniband
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
2025-10-03 18:35:22 -07:00
input
Merge tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2025-10-08 09:44:38 -07:00
interconnect
…
iommu
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
2025-10-03 18:18:48 -07:00
ipack
…
irqchip
irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
2025-10-07 10:23:22 +02:00
isdn
…
leds
leds: led-class: Add Device Tree support to led_get()
2025-09-16 16:49:28 +01:00
macintosh
…
mailbox
Merge tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox
2025-10-08 11:44:21 -07:00
mcb
…
md
Merge tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
2025-10-03 18:48:02 -07:00
media
Merge tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2025-10-04 16:07:08 -07:00
memory
…
memstick
Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-10-02 18:18:33 -07:00
message
…
mfd
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
misc
Merge tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2025-10-11 11:19:16 -07:00
mmc
Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-10-02 18:18:33 -07:00
most
…
mtd
Merge tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
2025-10-04 15:50:37 -07:00
mux
…
net
Merge tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-10-09 11:13:08 -07:00
nfc
…
ntb
NTB: epf: Add Renesas rcar support
2025-09-22 09:35:21 -04:00
nubus
…
nvdimm
Merge tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2025-10-06 11:17:18 -07:00
nvme
Merge tag 'for-6.18/block-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2025-10-02 10:16:56 -07:00
nvmem
Merge tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-07 12:13:26 -07:00
of
Merge tag 'devicetree-fixes-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
2025-10-10 13:05:40 -07:00
opp
…
parisc
…
parport
…
pci
Merge tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2025-10-08 18:51:00 -07:00
pcmcia
…
peci
…
perf
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2025-10-07 08:59:25 -07:00
phy
Merge tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
2025-10-06 10:34:22 -07:00
pinctrl
Merge tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2025-10-06 10:41:03 -07:00
platform
Merge tag 'platform-drivers-x86-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
2025-10-04 15:28:18 -07:00
pmdomain
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
pnp
…
power
Merge tag 'for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
2025-10-01 13:02:59 -07:00
powercap
…
pps
…
ps3
…
ptp
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-10-01 10:14:49 +02:00
pwm
Merge tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
2025-10-01 11:34:12 -07:00
rapidio
…
ras
…
regulator
Merge tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
2025-10-01 12:04:12 -07:00
remoteproc
Merge tag 'rproc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
2025-10-04 15:45:17 -07:00
reset
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
rpmsg
rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
2025-09-20 21:29:48 -05:00
rtc
Merge tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
2025-10-11 11:56:47 -07:00
s390
Merge tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2025-10-09 10:51:43 -07:00
sbus
…
scsi
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2025-10-11 11:49:00 -07:00
sh
…
siox
…
slimbus
…
soc
Merge tag 'mips_6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
2025-10-05 10:09:55 -07:00
soundwire
Merge tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
2025-10-06 10:32:22 -07:00
spi
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
spmi
…
ssb
…
staging
Merge tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
2025-10-07 11:41:06 -07:00
target
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2025-10-11 11:49:00 -07:00
tc
…
tee
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
thermal
thermal: renesas: Fix RZ/G3E fall-out
2025-10-02 10:41:58 +02:00
thunderbolt
thunderbolt: Fix use-after-free in tb_dp_dprx_work
2025-09-23 17:16:38 +02:00
tty
Merge tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2025-10-07 11:36:01 -07:00
ufs
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2025-10-11 11:49:00 -07:00
uio
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00
usb
Merge tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2025-10-04 16:07:08 -07:00
vdpa
vduse: Use fixed 4KB bounce pages for non-4KB page size
2025-10-01 07:24:55 -04:00
vfio
vfio: Dump migration features under debugfs
2025-10-06 11:22:48 -06:00
vhost
vdpa: support virtio_map
2025-10-01 07:24:43 -04:00
video
Merge tag 'fbdev-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
2025-10-10 09:36:23 -07:00
virt
Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2025-09-29 18:48:39 -07:00
virtio
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2025-10-04 08:48:16 -07:00
w1
…
watchdog
Merge tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog
2025-10-06 11:00:30 -07:00
xen
Merge tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
2025-10-03 17:41:12 -07:00
zorro
…
Kconfig
…
Makefile
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00