Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Junjie Cao a10cede006 fbdev: bitblit: bound-check glyph index in bit_putcs* ... commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream. bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot. Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2 Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-12-03 12:45:04 +01:00
..
accessibility
acpi	ACPI: video: Fix use-after-free in acpi_video_switch_brightness()	2025-12-03 12:45:04 +01:00
amba
android	binder: remove "invalid inc weak" check	2025-10-29 14:00:00 +01:00
ata	ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig	2025-08-28 16:21:35 +02:00
atm	atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().	2025-09-04 14:05:54 +02:00
auxdisplay
base	drivers/base/node: fix double free in register_one_node()	2025-10-29 13:59:49 +01:00
bcma
block	drbd: add missing kref_get in handle_write_conflicts	2025-08-28 16:21:24 +02:00
bluetooth	Bluetooth: btrtl: Prevent potential NULL dereference	2025-05-02 07:39:19 +02:00
bus	Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"	2025-06-27 11:02:55 +01:00
cdrom
char	tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single	2025-10-29 13:59:52 +01:00
clk	clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver	2025-10-29 13:59:51 +01:00
clocksource	clocksource/drivers/clps711x: Fix resource leaks in error paths	2025-10-29 13:59:50 +01:00
connector
counter	counter: stm32-lptimer-cnt: fix error handling when enabling	2025-04-10 14:29:39 +02:00
cpufreq	cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()	2025-10-29 13:59:52 +01:00
cpuidle	Revert "cpuidle: menu: Avoid discarding useful information"	2025-10-29 13:59:59 +01:00
crypto	crypto: atmel - Fix dma_unmap_sg() direction	2025-10-29 13:59:52 +01:00
dax
dca
devfreq
dio
dma	dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees	2025-10-02 13:34:29 +02:00
dma-buf	dma-buf: fix timeout handling in dma_resv_wait_timeout v2	2025-07-17 18:25:04 +02:00
edac	EDAC/altera: Delete an inappropriate dma_free_coherent() call	2025-10-02 13:34:27 +02:00
eisa
extcon
firewire
firmware	firmware: meson_sm: fix device leak at probe	2025-10-29 13:59:52 +01:00
fpga	fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()	2025-08-28 16:21:32 +02:00
fsi
gnss
gpio	gpio: pca953x: fix IRQ storm on system wake up	2025-09-09 18:44:00 +02:00
gpu	drm/amdgpu: use atomic functions with memory barriers for vm fault info	2025-10-29 14:00:01 +01:00
greybus
hid	HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()	2025-09-04 14:05:56 +02:00
hsi	HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition	2025-05-02 07:39:18 +02:00
hv	Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()	2025-04-10 14:29:35 +02:00
hwmon	hwmon: (occ) fix unaligned accesses	2025-06-27 11:02:57 +01:00
hwspinlock
hwtracing	coresight: catu: Fix number of pages while using 64k pages	2025-04-10 14:29:41 +02:00
i2c	i2c: designware: Add disabling clocks when probe fails	2025-10-29 13:59:47 +01:00
i3c	i3c: don't fail if GETHDRCAP is unsupported	2025-08-28 16:21:29 +02:00
ide
idle
iio	iio: frequency: adf4350: Fix prescaler usage.	2025-10-29 13:59:53 +01:00
infiniband	RDMA/siw: Always report immediate post SQ errors	2025-10-29 13:59:49 +01:00
input	Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak	2025-10-29 13:59:50 +01:00
interconnect
iommu	iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid	2025-06-04 14:32:26 +02:00
ipack
irqchip	irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()	2025-06-04 14:32:25 +02:00
isdn	mISDN: Fix memory leak in dsp_hwec_enable()	2025-09-09 18:43:57 +02:00
leds	leds: lp8860: Write full EEPROM, not only half of it	2025-03-13 12:43:06 +01:00
lightnvm
macintosh
mailbox	mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes	2025-10-29 13:59:52 +01:00
mcb	mcb: fix a double free bug in chameleon_parse_gdd()	2025-05-02 07:39:26 +02:00
md	dm: fix NULL pointer dereference in __dm_suspend()	2025-10-29 13:59:55 +01:00
media	media: s5p-mfc: remove an unused/uninitialized variable	2025-10-29 14:00:01 +01:00
memory	memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe	2025-10-29 14:00:00 +01:00
memstick	memstick: Fix deadlock by moving removing flag earlier	2025-08-28 16:21:32 +02:00
message	scsi: fusion: Remove unused variable 'rc'	2024-12-14 19:44:29 +01:00
mfd	mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag	2025-10-29 13:59:55 +01:00
misc	misc: genwqe: Fix incorrect cmd field being reported in error	2025-10-29 13:59:48 +01:00
mmc	mmc: core: SPI mode remove cmd7	2025-10-29 13:59:53 +01:00
mtd	spi: cadence-quadspi: Flush posted register writes before DAC access	2025-10-29 14:00:00 +01:00
mux
net	net: usb: asix_devices: Check return value of usbnet_get_endpoints	2025-12-03 12:45:04 +01:00
nfc
ntb	ntb: reduce stack usage in idt_scan_mws	2025-05-02 07:39:28 +02:00
nubus
nvdimm	libnvdimm/labels: Fix divide error in nd_label_data_init()	2025-06-04 14:32:30 +02:00
nvme	nvmet-tcp: don't restore null sk_state_change	2025-06-04 14:32:35 +02:00
nvmem	nvmem: core: improve range check for nvmem_cell_write()	2025-03-13 12:43:10 +01:00
of	of: module: add buffer overflow check in of_modalias()	2025-06-04 14:32:25 +02:00
opp
oprofile
parisc
parport	parport_pc: add support for ASIX AX99100	2025-03-13 12:43:19 +01:00
pci	PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit	2025-10-29 13:59:54 +01:00
pcmcia	pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch	2025-10-02 13:34:30 +02:00
perf	perf: arm_spe: Prevent overflow in PERF_IDX2OFF()	2025-10-29 13:59:46 +01:00
phy	phy: ti-pipe3: fix device leak at unbind	2025-10-02 13:34:30 +02:00
pinctrl	pinctrl: check the return value of pinmux_ops::get_function_name()	2025-10-29 13:59:50 +01:00
platform	platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches	2025-08-28 16:21:25 +02:00
pnp
power	power: supply: bq27xxx: restrict no-battery detection to bq27000	2025-10-02 13:34:31 +02:00
powercap	powercap: call put_device() on an error path in powercap_register_control_type()	2025-04-10 14:29:36 +02:00
pps	pps: fix warning in pps_register_cdev when register device fail	2025-10-29 13:59:48 +01:00
ps3
ptp	ptp: Ensure info->enable callback is always set	2025-03-13 12:43:11 +01:00
pwm	pwm: berlin: Fix wrong register in suspend/resume	2025-10-29 13:59:56 +01:00
rapidio	drivers/rapidio/rio_cm.c: prevent possible heap overwrite	2025-06-27 11:02:56 +01:00
ras
regulator	regulator: core: fix NULL dereference on unbind due to stale coupling data	2025-08-28 16:21:17 +02:00
remoteproc	remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice	2025-10-29 13:59:49 +01:00
reset
rpmsg	rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()	2025-06-27 11:02:48 +01:00
rtc	rtc: interface: Fix long-standing race when setting alarm	2025-10-29 13:59:53 +01:00
s390	scsi: s390: zfcp: Ensure synchronous unit_add	2025-06-27 11:02:56 +01:00
sbus
scsi	scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()	2025-10-29 13:59:53 +01:00
sfi
sh	sh: clk: Fix clk_enable() to return 0 on NULL clk	2025-01-09 13:23:29 +01:00
siox
slimbus	slimbus: messaging: Free transaction ID in delayed interrupt scenario	2025-03-13 12:43:33 +01:00
soc	soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS	2025-10-29 13:59:46 +01:00
soundwire	soundwire: stream: restore params when prepare ports fail	2025-08-28 16:21:21 +02:00
spi	spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort	2025-09-09 18:44:01 +02:00
spmi
ssb
staging	comedi: fix divide-by-zero in comedi_buf_munge()	2025-10-29 14:00:00 +01:00
target	scsi: target: target_core_configfs: Add length check to avoid buffer overflow	2025-10-29 13:59:44 +01:00
tc
tee	tee: Prevent size calculation wraparound on 32-bit kernels	2025-06-27 11:02:55 +01:00
thermal	thermal: sysfs: Return ENODATA instead of EAGAIN for reads	2025-08-28 16:21:25 +02:00
thunderbolt	thunderbolt: Fix copy+paste error in match_service_id()	2025-08-28 16:21:30 +02:00
tty	serial: max310x: Add error checking in probe()	2025-10-29 13:59:47 +01:00
uio	uio_hv_generic: Let userspace take care of interrupt mask	2025-10-29 13:59:50 +01:00
usb	xhci: dbc: enable back DbC in resume if it was enabled before suspend	2025-10-29 14:00:00 +01:00
vfio	vfio/pci: Enable iowrite64 and ioread64 for vfio pci	2025-03-13 12:43:13 +01:00
vhost	vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()	2025-09-04 14:05:53 +02:00
video	fbdev: bitblit: bound-check glyph index in bit_putcs*	2025-12-03 12:45:04 +01:00
virt
virtio
visorbus
vlynq
vme
w1
watchdog	watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog	2025-10-29 13:59:48 +01:00
xen	xen/events: Update virq_to_irq on migration	2025-10-29 13:59:56 +01:00
zorro
Kconfig
Makefile