linux

mirror of https://github.com/torvalds/linux.git synced 2026-01-12 00:42:35 +08:00

Files

Mathias Krause a260bd22a3 media: mc: fix potential use-after-free in media_request_alloc()

Commit 6f504cbf10 ("media: convert media_request_alloc() to
FD_PREPARE()") moved the call to fd_install() (now hidden in
fd_publish()) before the snprintf(), making the later write to
potentially already freed memory, as userland is free to call
close() concurrently right after the call to fd_install() which
may end up in the request_fops.release() handler freeing 'req'.

Fixes: 6f504cbf10 ("media: convert media_request_alloc() to FD_PREPARE()")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Link: https://patch.msgid.link/20251209210903.603958-1-minipli@grsecurity.net
Signed-off-by: Christian Brauner <brauner@kernel.org>

2025-12-15 15:12:28 +01:00

cec

media: cec: Fix debugfs leak on bus_register() failure

2025-10-14 15:07:37 +02:00

common

Merge tag 'v6.18-rc5' into media-next

2025-11-11 12:44:28 +01:00

dvb-core

media: dvb_ca_en50221: fix "writen"->"written"

2025-11-03 15:58:41 +01:00

dvb-frontends

media: mn88443x: Use %pe format specifier