Marc Zyngier
4bae1afed4
HID: core: Sanitize event code and type when mapping input ...
commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.
When calling into hid_map_usage(), the passed event code is
blindly stored as is, even if it doesn't fit in the associated bitmap.
This event code can come from a variety of sources, including devices
masquerading as input devices, only a bit more "programmable".
Instead of taking the event code at face value, check that it actually
fits the corresponding bitmap, and if it doesn't:
- spit out a warning so that we know which device is acting up
- NULLify the bitmap pointer so that we catch unexpected uses
Code paths that can make use of untrusted inputs can now check
that the mapping was indeed correct and bail out if not.
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-05 11:22:49 +02:00
can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
2020-01-14 20:08:28 +01:00
libceph: fix alloc_msg_with_page_vector() memory leaks
2020-04-02 15:11:02 +02:00
net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop
2020-04-01 11:01:34 +02:00
gpio: add gpiod_toggle_active_low()
2020-02-19 19:53:09 +01:00
iio: core: remove extra semi-colon from devm_iio_device_register() macro
2020-04-29 16:33:12 +02:00
Input: elan_i2c - add more hardware ID for Lenovo laptops
2020-07-22 09:33:13 +02:00
mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt
2020-06-24 17:50:33 +02:00
net/mlx5e: Modify uplink state on interface up/down
2020-08-05 09:59:47 +02:00
mmc: core: Allow host controllers to require R1B for CMD6
2020-04-01 11:01:27 +02:00
netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
2020-06-03 08:21:39 +02:00
bus: ti-sysc: Handle module unlock quirk needed for some RTC
2020-07-22 09:32:58 +02:00
ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
2020-02-01 09:34:49 +00:00
net: qed: fix left elements count calculation
2020-06-30 15:36:58 -04:00
raid6/test: fix a compilation warning
2020-02-24 08:36:47 +01:00
regulator fix for "regulator: core: Add regulator_is_equal() helper"
2020-02-11 04:35:55 -08:00
sched/core: Fix illegal RCU from offline CPUs
2020-06-22 09:31:01 +02:00
nfsd: Fix NFSv4 READ on RDMA when using readv
2020-08-11 15:33:42 +02:00
usb: host: ehci-platform: add a quirk to avoid stuck
2020-06-24 17:50:44 +02:00
ACPI: PM: Add acpi_[un]register_wakeup_handler()
2020-04-13 10:48:08 +02:00
ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
2020-01-09 10:19:59 +01:00
bdi: add a ->dev_name field to struct backing_dev_info
2020-05-14 07:58:30 +02:00
bdi: move bdi_dev_name out of line
2020-05-14 07:58:30 +02:00
block: add bio_truncate to fix guard_bio_eod
2020-01-09 10:19:54 +01:00
bitfield.h: don't compile-time validate _val in FIELD_FIT
2020-08-19 08:16:28 +02:00
bitmap.h: fix kernel-doc warning and typo
2019-10-14 15:04:01 -07:00
include/linux/bitops.h: avoid clang shift-count-overflow warnings
2020-06-24 17:50:39 +02:00
blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
2020-07-22 09:32:52 +02:00
blktrace: Protect q->blk_trace with RCU
2020-03-05 16:43:52 +01:00
bpf: sockmap: Require attach_bpf_fd when detaching a program
2020-08-07 09:34:02 +02:00
ext4: use non-movable memory for superblock readahead
2020-04-23 10:36:15 +02:00
cgroup: Fix sock_cgroup_data on big-endian.
2020-07-22 09:32:50 +02:00
cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
2020-07-22 09:32:49 +02:00
mm, compaction: raise compaction priority after it withdrawns
2019-09-24 15:54:10 -07:00
futex: Move futex exit handling into futex code
2019-11-29 10:10:08 +01:00
x86: Fix early boot crash on gcc-10, third try
2020-05-20 08:20:34 +02:00
compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use
2019-10-11 09:26:05 -07:00
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
2020-04-17 10:50:11 +02:00
cpufreq: Avoid creating excessively large stack frames
2020-02-11 04:35:25 -08:00
padata: validate cpumask without removed CPU during offline
2020-02-24 08:36:34 +01:00
cpumask: nicer for_each_cpumask_and() signature
2019-09-25 17:51:40 -07:00
selinux/stable-5.4 PR 20190917
2019-09-23 11:21:04 -07:00
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
2020-04-17 10:50:09 +02:00
dm integrity: fix integrity recalculation that is improperly skipped
2020-07-29 10:18:45 +02:00
dmabuf: use spinlock to access dmabuf->name
2020-07-29 10:18:29 +02:00
dma-direct: check for overflows on 32 bit DMA addresses
2020-01-04 19:17:24 +01:00
dma-mapping: fix handling of dma-ranges for reserved memory (again)
2020-01-04 19:17:00 +01:00
dmaengine: Store module owner in dma_device struct
2020-02-24 08:36:40 +01:00
iommu/vt-d: Silence RCU-list debugging warnings
2020-04-01 11:01:53 +02:00
dynamic_debug: provide dynamic_hex_dump stub
2019-10-22 12:54:44 -07:00
efi: provide empty efi_enter_virtual_mode implementation
2020-09-03 11:26:49 +02:00
elfnote: mark all .note sections SHF_ALLOC
2020-06-17 16:40:20 +02:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:35:37 -08:00
symbol namespaces: revert to previous __ksymtab name scheme
2019-10-18 15:32:52 +02:00
f2fs: Add a new CP flag to help fsck fix resize SPO issues
2020-04-23 10:36:33 +02:00
fbmem: pull fbcon_update_vcs() out of fb_set_var()
2020-09-03 11:27:09 +02:00
bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
2020-07-16 08:16:45 +02:00
writeback: Avoid skipping inode writeback
2020-09-03 11:27:04 +02:00
fuse update for 5.4
2019-09-25 09:55:59 -07:00
fsnotify: replace inode pointer with an object id
2020-05-14 07:58:30 +02:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
block: nr_sects_write(): Disable preemption on seqcount write
2020-06-24 17:50:49 +02:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
HID: core: Sanitize event code and type when mapping input
2020-09-05 11:22:49 +02:00
hrtimer: Annotate lockless access to timer->state
2020-01-04 19:18:41 +01:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
mm/hugetlb: fix build failure with HUGETLB_PAGE but not HUGEBTLBFS
2020-04-23 10:36:36 +02:00
hwmon: Fix HWMON_P_MIN_ALARM mask
2019-10-02 06:36:50 -07:00
Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
2020-08-11 15:33:38 +02:00
Merge branch 'i2c/for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2019-09-24 16:48:02 -07:00
XArray updates for 5.4
2019-11-08 08:46:49 -08:00
ieee80211: Fix incorrect mask for default PE duration
2020-06-03 08:21:36 +02:00
macvlan: do not assume mac_header is set in macvlan_broadcast()
2020-01-12 12:21:46 +01:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
team: fix nested locking lockdep warning
2019-10-24 14:53:48 -07:00
vlan: consolidate VLAN parsing code and limit max parsing depth
2020-07-22 09:32:49 +02:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
inet_diag: return classid for all socket types
2020-03-18 07:17:38 +01:00
iommu/vt-d: Enforce PASID devTLB field mask
2020-08-21 13:05:34 +02:00
iommu/vt-d: Fix compile warning from intel-svm.h
2020-02-28 17:22:26 +01:00
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
io-mapping: indicate mapping failure
2020-07-29 10:18:44 +02:00
lib: devres: add a helper function for ioremap_uc
2020-05-10 10:31:30 +02:00
block: Fix use-after-free issue accessing struct io_cq
2020-04-17 10:50:04 +02:00
/dev/mem: Revoke mappings when a driver claims the region
2020-06-24 17:50:35 +02:00
ipmi: Don't allow device module unload when in use
2019-12-31 16:44:14 +01:00
genirq/affinity: Make affinity setting if activated opt-in
2020-08-21 13:05:20 +02:00
genirq/irqdomain: Make sure all irq domain flags are distinct
2020-02-28 17:22:20 +01:00
jbd2: clean __jbd2_journal_abort_hard() and __journal_abort_soft()
2020-06-24 17:50:48 +02:00
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
kernfs: fix ino wrap-around detection
2019-12-13 08:42:53 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:36:45 +02:00
kgdb: Fix spurious true from in_dbg_master()
2020-06-22 09:31:03 +02:00
khugepaged: enable collapse pmd for pte-mapped THP
2019-09-24 15:54:11 -07:00
kretprobe: Prevent triggering kretprobe from within kprobe_flush_task
2020-06-24 17:50:52 +02:00
KVM: x86: Fix APIC page invalidation race
2020-06-17 16:40:26 +02:00
x86/kvm: Cache gfn to pfn translation
2020-02-11 04:35:40 -08:00
leds: core: Fix leds.h structure documentation
2019-10-08 22:05:58 +02:00
libata: Use per port sync for detach
2020-06-24 17:50:47 +02:00
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
2020-01-04 19:18:28 +01:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
mm, memcg: fix inconsistent oom event behavior
2020-05-20 08:20:27 +02:00
mm/memory_hotplug: fix try_offline_node()
2019-11-15 18:34:00 -08:00
mm/memory_hotplug: shrink zones when offlining memory
2020-01-09 10:19:56 +01:00
Revert "Revert "mm, thp: restore node-local hugepage allocations""
2019-09-28 14:05:38 -07:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
net: phy: micrel: Update KSZ87xx PHY name
2019-10-17 16:31:52 -07:00
net: phy: fix write to mii-ctrl1000 register
2019-10-04 18:11:08 -07:00
rfkill: allocate static minor
2019-12-13 08:43:18 +01:00
mm: add kvfree_sensitive() for freeing sensitive data objects
2020-06-17 16:40:23 +02:00
mm: thp: handle page cache THP correctly in PageTransCompoundMap
2019-11-06 08:28:58 -08:00
fork: improve error message for corrupted page tables
2019-09-25 17:51:40 -07:00
mm: initialize deferred pages with interrupts enabled
2020-06-22 09:31:14 +02:00
Input: add SW_MACHINE_COVER
2020-07-29 10:18:36 +02:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
2019-09-27 19:37:27 -07:00
net: core: reduce recursion limit value
2020-06-30 15:36:44 -04:00
netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
2020-09-03 11:26:58 +02:00
nfs: set invalid blocks after NFSv4 writes
2020-06-24 17:50:44 +02:00
NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
2020-05-06 08:15:05 +02:00
nvme-fc: Revert "add module to ops template to allow module references"
2020-04-17 10:50:10 +02:00
nvme: introduce "Command Aborted By host" status code
2019-12-31 16:44:40 +01:00
nvmem: core: fix nvmem_cell_write inline function
2019-12-31 16:44:43 +01:00
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
2020-06-17 16:40:22 +02:00
page-flags: fix a crash at SetPageError(THP_SWAP)
2020-03-25 08:25:58 +01:00
mm, page_owner: rename flag indicating that page is allocated
2019-10-14 15:04:00 -07:00
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
PCI: endpoint: Fix for concurrent memory allocation in OB address region
2020-04-17 10:50:11 +02:00
PCI: Add nr_devfns parameter to pci_add_dma_alias()
2020-02-24 08:36:37 +01:00
x86/amd_nb: Add AMD family 17h model 60h PCI IDs
2020-06-22 09:31:17 +02:00
percpu: Separate decrypted varaibles anytime encryption can be enabled
2020-02-11 04:35:44 -08:00
percpu_counter: fix a data race at vm_committed_as
2020-04-23 10:36:37 +02:00
perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/
2019-10-28 11:02:01 +01:00
net: phy: fix MDIO bus PM PHY resuming
2020-03-18 07:17:46 +01:00
driver code: clarify and fix platform device DMA mask allocation
2020-03-18 07:17:56 +01:00
PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
2019-12-21 11:04:31 +01:00
pnp: Use list_for_each_entry() instead of open coding
2020-05-20 08:20:27 +02:00
ptp: fix the race between the release of ptp_clock and cdev
2020-01-04 19:18:48 +01:00
random32: move the pseudo-random 32-bit definitions to prandom.h
2020-08-07 09:34:01 +02:00
printk: queue wake_up_klogd irq_work only if per-CPU areas are ready
2020-05-02 08:48:42 +02:00
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 19:17:25 +01:00
quota: Check that quota is not dirty before release
2019-12-17 19:56:43 +01:00
radix tree: Remove radix_tree_iter_find
2019-11-01 22:26:34 -04:00
random32: move the pseudo-random 32-bit definitions to prandom.h
2020-08-07 09:34:01 +02:00
augmented rbtree: rework the RB_DECLARE_CALLBACKS macro definition
2019-09-25 17:51:39 -07:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
tasks, sched/core: With a grace period after finish_task_switch(), remove unnecessary code
2019-09-25 17:42:29 +02:00
reset: fix reset_control_ops kerneldoc comment
2019-10-28 12:18:23 +01:00
reset: fix reset_control_get_exclusive kerneldoc comment
2019-10-24 10:26:33 +02:00
rhashtable: Fix unprotected RCU dereference in __rht_ptr
2020-08-05 09:59:47 +02:00
signal: Extend exec_id to 64bits
2020-04-17 10:50:12 +02:00
powerpc/xmon: Restrict when kernel is locked down
2020-06-07 13:18:49 +02:00
vt: selection, introduce vc_is_sel
2020-04-02 15:11:00 +02:00
x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned
2020-06-17 16:40:31 +02:00
mm: shrinker: make shrinker not depend on memcg kmem
2019-09-24 15:54:11 -07:00
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
2020-04-01 11:02:18 +02:00
bpf: sockmap: Require attach_bpf_fd when detaching a program
2020-08-07 09:34:02 +02:00
mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)
2019-10-07 15:47:20 -07:00
net: increase SOMAXCONN to 4096
2019-10-31 14:01:40 -07:00
string.h: fix incompatibility between FORTIFY_SOURCE and KASAN
2020-06-22 09:31:12 +02:00
ACPI: PM: s2idle: Avoid possible race related to the EC GPE
2020-02-19 19:52:56 +01:00
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-13 10:48:07 +02:00
mm: introduce MADV_PAGEOUT
2019-09-25 17:51:41 -07:00
include/linux/swapops.h: correct guards for non_swap_entry()
2020-04-23 10:36:37 +02:00
sysfs: Fixes __BIN_ATTR_WO() macro
2019-10-02 10:06:45 +02:00
tcp: allow at most one TLP probe per flight
2020-07-31 18:39:31 +02:00
uaccess: disallow > INT_MAX copy sizes
2020-01-04 19:18:42 +01:00
tcp: fix rejected syncookies due to stale timestamps
2019-12-18 16:08:43 +01:00
bpf: Fix incorrect verifier simulation of ARSH under ALU32
2020-01-23 08:22:44 +01:00
tpm: Unify the mismatching TPM space buffer sizes
2020-08-19 08:16:27 +02:00
tpm: Require that all digests are present in TCG_PCR_EVENT2 structures
2020-08-19 08:15:57 +02:00
tracepoint: Mark __tracepoint_string's __used
2020-08-19 08:15:53 +02:00
gcc-10 warnings: fix low-hanging fruit
2020-05-20 08:20:29 +02:00
uaccess: Add non-pagefault user-space write function
2020-01-17 19:48:40 +01:00
net: be more gentle about silly gso requests coming from user
2020-06-10 20:24:55 +02:00
vsock/virtio: remove unused 'work' field from 'struct virtio_vsock_pkt'
2019-10-28 04:25:04 -04:00
vmalloc: fix remap_vmalloc_range() bounds checks
2020-04-29 16:33:14 +02:00
vt: switch vt_dont_switch to bool
2020-04-02 15:11:00 +02:00
xarray: Fix early termination of xas_for_each_marked
2020-04-17 10:50:18 +02:00
xattr: break delegations in {set,remove}xattr
2020-08-11 15:33:39 +02:00
zpool: add malloc_support_movable to zpool_driver
2019-09-24 15:54:12 -07:00
