All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sean Young <sean@mess.org>
To: linux-media@vger.kernel.org
Cc: Sean Young <sean@mess.org>, bpf@vger.kernel.org
Subject: [PATCH v3 00/13] Fix leaks in rc core
Date: Wed, 22 Jul 2026 11:23:12 +0100	[thread overview]
Message-ID: <cover.1784715737.git.sean@mess.org> (raw)

Changes since v2:
 - sashiko had many more good review comments

Changes since v1:
 - sashiko had many good review comments
 - Added fix rc: Use after free in ir_raw_event_handle()
 - Added fix meson-ir-tx: Ensure probe error is propagated
 - Added fix redrat3: Ensure all urbs are suspended
 - Added fix media: redrat3: Error path leaves device in transmitting state
 - streamzap fix was incorrect
 - Other minor fixes


Sean Young (13):
  media: streamzap: Add missing rc_unregister_device()
  media: redrat3: Ensure rc device is freed if enable_detector() fails
  media: redrat3: Ensure we don't read beyond the end of the packet
  media: redrat3: Ensure all urbs are suspended
  media: redrat3: Error path leaves device in transmitting state
  media: sunxi-cir: Ensure no more interrupts can occur before free
  media: meson-ir-tx: Ensure clock is disabled on unbind
  media: meson-ir-tx: Ensure rc_free_device() is called on unbind
  media: meson-ir-tx: Ensure probe error is propagated
  media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled
  media: rc: Use after free in ir_raw_event_handle()
  media: rc: Fix use after free in bpf progs
  media: rc: Fix race condition during rc_register_device()

 drivers/media/rc/bpf-lirc.c    | 18 ++++++++++-----
 drivers/media/rc/ir-hix5hd2.c  |  5 +++--
 drivers/media/rc/meson-ir-tx.c | 14 +++++-------
 drivers/media/rc/rc-ir-raw.c   | 40 ++++++++++------------------------
 drivers/media/rc/rc-main.c     | 18 +++++++++------
 drivers/media/rc/redrat3.c     | 35 ++++++++++++++++++++++++-----
 drivers/media/rc/streamzap.c   |  1 +
 drivers/media/rc/sunxi-cir.c   |  2 +-
 8 files changed, 75 insertions(+), 58 deletions(-)

-- 
2.55.0


             reply	other threads:[~2026-07-22 10:23 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-22 10:23 Sean Young [this message]
2026-07-22 10:23 ` [PATCH v3 01/13] media: streamzap: Add missing rc_unregister_device() Sean Young
2026-07-22 10:23 ` [PATCH v3 02/13] media: redrat3: Ensure rc device is freed if enable_detector() fails Sean Young
2026-07-22 10:23 ` [PATCH v3 03/13] media: redrat3: Ensure we don't read beyond the end of the packet Sean Young
2026-07-22 10:23 ` [PATCH v3 04/13] media: redrat3: Ensure all urbs are suspended Sean Young
2026-07-22 10:23 ` [PATCH v3 05/13] media: redrat3: Error path leaves device in transmitting state Sean Young
2026-07-22 10:23 ` [PATCH v3 06/13] media: sunxi-cir: Ensure no more interrupts can occur before free Sean Young
2026-07-22 10:36   ` sashiko-bot
2026-07-22 10:23 ` [PATCH v3 07/13] media: meson-ir-tx: Ensure clock is disabled on unbind Sean Young
2026-07-22 10:23   ` Sean Young
2026-07-22 10:34   ` sashiko-bot
2026-07-22 10:23 ` [PATCH v3 08/13] media: meson-ir-tx: Ensure rc_free_device() is called " Sean Young
2026-07-22 10:23   ` Sean Young
2026-07-22 10:23 ` [PATCH v3 09/13] media: meson-ir-tx: Ensure probe error is propagated Sean Young
2026-07-22 10:23   ` Sean Young
2026-07-22 10:23 ` [PATCH v3 10/13] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Sean Young
2026-07-22 10:23 ` [PATCH v3 11/13] media: rc: Use after free in ir_raw_event_handle() Sean Young
2026-07-22 10:23 ` [PATCH v3 12/13] media: rc: Fix use after free in bpf progs Sean Young
2026-07-22 10:49   ` sashiko-bot
2026-07-22 10:23 ` [PATCH v3 13/13] media: rc: Fix race condition during rc_register_device() Sean Young

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1784715737.git.sean@mess.org \
    --to=sean@mess.org \
    --cc=bpf@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.