No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Ian Abbott 454d732dfd comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
[ Upstream commit 08ae4b20f5e82101d77326ecab9089e110f224cc ]

The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to
hold the array of `struct comedi_insn`, getting the length from the
`n_insns` member of the `struct comedi_insnlist` supplied by the user.
The allocation will fail with a WARNING and a stack dump if it is too
large.

Avoid that by failing with an `-EINVAL` error if the supplied `n_insns`
value is unreasonable.

Define the limit on the `n_insns` value in the `MAX_INSNS` macro.  Set
this to the same value as `MAX_SAMPLES` (65536), which is the maximum
allowed sum of the values of the member `n` in the array of `struct
comedi_insn`, and sensible comedi instructions will have an `n` of at
least 1.

Reported-by: syzbot+d6995b62e5ac7d79557a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d6995b62e5ac7d79557a
Fixes: ed9eccbe89 ("Staging: add comedi core")
Tested-by: Ian Abbott <abbotti@mev.co.uk>
Cc: stable@vger.kernel.org # 5.13+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20250704120405.83028-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Reworked for before commit bac42fb21259 ("comedi: get rid of compat_alloc_user_space() mess in COMEDI_CMD{,TEST} compat") ]
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:33 +02:00
arch mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation 2025-08-28 16:21:33 +02:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:29:37 +02:00
certs
crypto crypto: algif_hash - fix double free in hash_accept 2025-06-04 14:32:35 +02:00
Documentation Documentation: ACPI: Fix parent device references 2025-08-28 16:21:23 +02:00
drivers comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large 2025-08-28 16:21:33 +02:00
fs use uniform permission checks for all mount propagation changes 2025-08-28 16:21:32 +02:00
include move_mount: allow to add a mount into an existing group 2025-08-28 16:21:32 +02:00
init bpfilter: match bit size of bpfilter_umh to that of the kernel 2025-07-17 18:24:51 +02:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:02:52 +01:00
kernel ftrace: Also allocate and copy hash for reading of filter files 2025-08-28 16:21:32 +02:00
lib lib: test_objagg: Set error message in check_expect_hints_stats() 2025-07-17 18:24:56 +02:00
LICENSES
mm mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() 2025-08-28 16:21:30 +02:00
net net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:21:27 +02:00
samples samples: mei: Fix building on musl libc 2025-08-28 16:21:19 +02:00
scripts kbuild: Add KBUILD_CPPFLAGS to as-option invocation 2025-08-28 16:21:33 +02:00
security securityfs: don't pin dentries twice, once is enough... 2025-08-28 16:21:24 +02:00
sound ASoC: codecs: rt5640: Retry DEVICE_ID verification 2025-08-28 16:21:26 +02:00
tools ktest.pl: Prevent recursion of default variable options 2025-08-28 16:21:26 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-07-17 18:24:51 +02:00
virt KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status 2024-12-19 18:05:04 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS platform: Add Surface platform directory 2025-06-27 11:02:56 +01:00
Makefile kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS 2025-08-28 16:21:33 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.