Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Anssi Hannula 76d9afd30e can: kvaser_usb_leaf: Fix overread with an invalid command ... commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream. For command events read from the device, kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not exceed the size of the received data, but the actual kvaser_cmd handlers will happily read any kvaser_cmd fields without checking for cmd->len. This can cause an overread if the last cmd in the buffer is shorter than expected for the command type (with cmd->len showing the actual short size). Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of which are delivered to userspace as-is. Fix that by verifying the length of command before handling it. This issue can only occur after RX URBs have been set up, i.e. the interface has been opened at least once. Cc: stable@vger.kernel.org Fixes: 080f40a6fa ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Tested-by: Jimmy Assarsson <extja@kvaser.com> Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi> Signed-off-by: Jimmy Assarsson <extja@kvaser.com> Link: https://lore.kernel.org/all/20221010150829.199676-2-extja@kvaser.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-10-26 13:22:13 +02:00
..
accessibility
acpi	ACPI: processor: Remove freq Qos request for all CPUs	2022-09-05 10:27:44 +02:00
amba
android	binder: fix UAF of ref->proc caused by race condition	2022-09-15 12:04:51 +02:00
ata	libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205	2022-10-05 10:37:42 +02:00
atm	atm: idt77252: fix use-after-free bugs caused by tst_timer	2022-08-25 11:18:26 +02:00
auxdisplay
base	x86/bugs: Report AMD retbleed vulnerability	2022-10-07 09:16:54 +02:00
bcma
block	loop: Check for overflow while configuring loop	2022-09-05 10:27:43 +02:00
bluetooth	Bluetooth: hci_intel: Add check for platform_driver_register	2022-08-25 11:17:47 +02:00
bus	bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()	2022-08-25 11:17:35 +02:00
cdrom
char	random: use expired timer rather than wq for mixing fast pool	2022-10-15 07:54:40 +02:00
clk	clk: iproc: Do not rely on node name for correct PLL setup	2022-10-05 10:37:45 +02:00
clocksource	clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()	2022-07-07 17:36:53 +02:00
connector
counter
cpufreq	x86/devicetable: Move x86 specific macro out of generic code	2022-10-07 09:16:54 +02:00
cpuidle
crypto	crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of	2022-08-25 11:17:48 +02:00
dax	dax: make sure inodes are flushed before destroy cache	2022-04-15 14:18:12 +02:00
dca
devfreq	PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events	2022-07-07 17:36:49 +02:00
dio
dma	dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure	2022-10-15 07:54:37 +02:00
dma-buf	udmabuf: Set the DMA mask for the udmabuf device (v2)	2022-09-05 10:27:45 +02:00
edac	EDAC/synopsys: Read the error count from the correct register	2022-04-27 13:50:48 +02:00
eisa
extcon	extcon: Modify extcon device to be created after driver data is set	2022-06-14 18:12:00 +02:00
firewire	firewire: core: extend card->lock in fw_core_handle_bus_reset	2022-05-12 12:23:41 +02:00
firmware	firmware: arm_scmi: Add SCMI PM driver remove routine	2022-10-15 07:54:37 +02:00
fpga	fpga: altera-pr-ip: fix unsigned comparison with less than zero	2022-08-25 11:17:51 +02:00
fsi
gnss
gpio	gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx	2022-09-28 11:03:57 +02:00
gpu	Revert "drm/amdgpu: use dirty framebuffer helper"	2022-10-07 09:16:57 +02:00
greybus	greybus: svc: fix an error handling bug in gb_svc_hello()	2022-04-15 14:17:58 +02:00
hid	hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message	2022-09-20 12:27:59 +02:00
hsi
hv	Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region	2022-09-28 11:04:08 +02:00
hwmon	hwmon: (gpio-fan) Fix array out of bounds access	2022-09-15 12:04:52 +02:00
hwspinlock
hwtracing	intel_th: pci: Add Meteor Lake-P support	2022-08-25 11:18:13 +02:00
i2c	i2c: mux-gpmux: Add of_node_put() when breaking out of loop	2022-08-25 11:17:47 +02:00
i3c
ide
idle	intel_idle: Disable IBRS during long idle	2022-10-07 09:16:55 +02:00
iio	iio: pressure: dps310: Reset chip after timeout	2022-10-26 13:22:12 +02:00
infiniband	RDMA/mlx5: Set local port to one when accessing counters	2022-09-15 12:04:55 +02:00
input	Input: xpad - fix wireless 360 controller breaking after suspend	2022-10-15 07:54:41 +02:00
interconnect
iommu	iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)	2022-08-25 11:18:15 +02:00
ipack
irqchip	irqchip/tegra: Fix overflow implicit truncation warnings	2022-08-25 11:18:32 +02:00
isdn
leds
lightnvm	lightnvm: disable the subsystem	2022-05-09 09:03:20 +02:00
macintosh	macintosh/adb: fix oob read in do_adb_query() function	2022-08-11 12:57:53 +02:00
mailbox	mailbox: forward the hrtimer if not queued and under a lock	2022-06-14 18:11:42 +02:00
mcb
md	md: call __md_stop_writes in md_stop	2022-09-05 10:27:44 +02:00
media	media: dvb_vb2: fix possible out of bound access	2022-10-05 10:37:43 +02:00
memory	memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe	2022-04-20 09:19:34 +02:00
memstick	memstick/ms_block: Fix a memory leak	2022-08-25 11:17:55 +02:00
message
mfd	mfd: max77620: Fix refcount leak in max77620_initialise_fps	2022-08-25 11:18:04 +02:00
misc	misc: fastrpc: fix memory corruption on open	2022-09-15 12:04:51 +02:00
mmc	mmc: core: Terminate infinite loop in SD-UHS voltage switch	2022-10-15 07:54:38 +02:00
mtd	mtd: rawnand: atmel: Unmap streaming DMA mappings	2022-10-26 13:22:11 +02:00
mux
net	can: kvaser_usb_leaf: Fix overread with an invalid command	2022-10-26 13:22:13 +02:00
nfc	NFC: nxp-nci: don't print header length mismatch on i2c error	2022-07-21 20:59:25 +02:00
ntb	NTB: ntb_tool: uninitialized heap data in tool_fn_write()	2022-08-25 11:18:26 +02:00
nubus
nvdimm	nvdimm: Fix badblocks clear off-by-one error	2022-07-07 17:36:48 +02:00
nvme	nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices	2022-10-05 10:37:45 +02:00
nvmem
of	of: mdio: Add of_node_put() when breaking out of for_each_xx	2022-09-28 11:04:06 +02:00
opp	opp: Fix error check in dev_pm_opp_attach_genpd()	2022-08-25 11:18:00 +02:00
oprofile
parisc	parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()	2022-09-28 11:03:57 +02:00
parport
pci	PCI: Add ACS quirk for Broadcom BCM5750x NICs	2022-08-25 11:18:31 +02:00
pcmcia	pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards	2022-06-14 18:11:50 +02:00
perf	perf/arm_pmu_platform: fix tests for platform_get_irq() failure	2022-09-20 12:27:59 +02:00
phy	phy: qcom-qmp: fix pipe-clock imbalance on power-on failure	2022-06-14 18:11:52 +02:00
pinctrl	pinctrl: amd: Don't save/restore interrupt status and wake status bits	2022-09-05 10:27:39 +02:00
platform	platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes	2022-09-20 12:28:00 +02:00
pnp
power	power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe	2022-07-29 17:14:10 +02:00
powercap
pps
ps3
ptp	ptp: replace snprintf with sysfs_emit	2022-04-15 14:18:32 +02:00
pwm	pwm: lp3943: Fix duty calculation in case period was clamped	2022-06-14 18:11:51 +02:00
rapidio
ras
regulator	regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()	2022-09-28 11:03:58 +02:00
remoteproc	remoteproc: qcom: wcnss: Fix handling of IRQs	2022-08-25 11:18:02 +02:00
reset	reset: tegra-bpmp: Restore Handle errors in BPMP response	2022-04-27 13:50:47 +02:00
rpmsg	rpmsg: qcom: glink: replace strncpy() with strscpy_pad()	2022-10-15 07:54:38 +02:00
rtc	rtc: mt6397: check return value after calling platform_get_resource()	2022-06-14 18:11:53 +02:00
s390	s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup	2022-09-28 11:04:08 +02:00
sbus
scsi	scsi: stex: Properly zero out the passthrough command structure	2022-10-15 07:54:39 +02:00
sfi
sh
siox
slimbus	slimbus: qcom: Fix IRQ check in qcom_slim_probe	2022-05-18 09:47:27 +02:00
soc	soc: sunxi: sram: Fix debugfs info for A64 SRAM C	2022-10-05 10:37:44 +02:00
soundwire	soundwire: bus_type: fix remove and shutdown support	2022-08-25 11:17:54 +02:00
spi	spi: spi-rspi: Fix PIO fallback on RZ platforms	2022-08-25 11:17:32 +02:00
spmi
ssb
staging	staging: rtl8712: fix use after free bugs	2022-09-15 12:04:50 +02:00
target	scsi: target: tcmu: Fix possible page UAF	2022-04-20 09:19:36 +02:00
tc
tee	tee: add overflow check in register_shm_helper()	2022-08-25 11:18:27 +02:00
thermal	thermal: sysfs: Fix cooling_device_stats_setup() error code path	2022-08-25 11:17:22 +02:00
thunderbolt	thunderbolt: Use the actual buffer in tb_async_error()	2022-09-15 12:04:52 +02:00
tty	serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting	2022-09-28 11:04:08 +02:00
uio
usb	usb: add quirks for Lenovo OneLink+ Dock	2022-10-26 13:22:12 +02:00
vfio	vfio: Clear the caps->buf to NULL after free	2022-08-25 11:18:36 +02:00
vhost	vringh: Fix loop descriptors check in the indirect cases	2022-06-14 18:12:02 +02:00
video	video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write	2022-09-28 11:03:59 +02:00
virt	vboxguest: Do not use devm for irq	2022-08-25 11:18:33 +02:00
virtio	virtio_mmio: Restore guest page size on resume	2022-07-21 20:59:24 +02:00
visorbus
vlynq
vme
w1	w1: w1_therm: fixes w1_seq for ds28ea00 sensors	2022-04-15 14:18:35 +02:00
watchdog	watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()	2022-08-25 11:18:06 +02:00
xen	xen/xenbus: fix return type in xenbus_file_read()	2022-08-25 11:18:26 +02:00
zorro
Kconfig
Makefile