Andrew Morton
a8b5ea2e30
drivers/rapidio/rio_cm.c: prevent possible heap overwrite ...
commit 50695153d7ddde3b1696dbf0085be0033bf3ddb3 upstream.
In
riocm_cdev_ioctl(RIO_CM_CHAN_SEND)
-> cm_chan_msg_send()
-> riocm_ch_send()
cm_chan_msg_send() checks that userspace didn't send too much data but
riocm_ch_send() failed to check that userspace sent sufficient data. The
result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr
which were outside the bounds of the space which cm_chan_msg_send()
allocated.
Address this by teaching riocm_ch_send() to check that the entire
rio_ch_chan_hdr was copied in from userspace.
Reported-by: maher azz <maherazz04@gmail.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:02:56 +01:00
ACPI: battery: negate current when discharging
2025-06-27 11:02:53 +01:00
binder: fix UAF caused by offsets overwrite
2024-09-12 11:03:55 +02:00
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
2025-06-27 11:02:51 +01:00
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
2025-06-27 11:02:53 +01:00
nbd: don't allow reconnect after disconnect
2025-03-13 12:42:52 +01:00
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
2025-06-27 11:02:55 +01:00
virtio_console: fix missing byte order handling for cols and rows
2025-05-02 07:39:26 +02:00
clk: rockchip: rk3036: mark ddrphy as critical
2025-06-27 11:02:55 +01:00
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
2025-06-04 14:32:29 +02:00
counter: stm32-lptimer-cnt: fix error handling when enabling
2025-04-10 14:29:39 +02:00
cpufreq: Force sync policy boost with global boost on sysfs update
2025-06-27 11:02:54 +01:00
cpuidle: menu: Avoid discarding useful information
2025-06-04 14:32:32 +02:00
crypto: marvell/cesa - Avoid empty transfer descriptor
2025-06-27 11:02:45 +01:00
dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
2025-06-04 14:32:29 +02:00
udmabuf: fix a buf size overflow issue during udmabuf creation
2025-05-02 07:39:29 +02:00
EDAC/altera: Use correct write width with the INTTEST register
2025-06-27 11:02:51 +01:00
firmware: psci: Fix refcount leak in psci_dt_init
2025-06-27 11:02:46 +01:00
fpga: altera-cvp: Increase credit timeout
2025-06-04 14:32:32 +02:00
gpio: zynq: Fix wakeup source leaks on device unbind
2025-05-02 07:39:17 +02:00
drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
2025-06-27 11:02:54 +01:00
HID: quirks: Add ADATA XPG alpha wireless mouse support
2025-06-04 14:32:37 +02:00
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
2025-04-10 14:29:35 +02:00
hwmon: (xgene-hwmon) use appropriate type for the latency value
2025-06-04 14:32:34 +02:00
coresight: catu: Fix number of pages while using 64k pages
2025-04-10 14:29:41 +02:00
i2c: designware: Invoke runtime suspend on quick slave re-registration
2025-06-27 11:02:54 +01:00
i3c: Add NULL pointer check in i3c_master_queue_ibi()
2025-05-02 07:39:15 +02:00
iio: adc: ad7606_spi: fix reg write value mask
2025-06-27 11:02:52 +01:00
RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
2025-06-27 11:02:46 +01:00
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
2025-06-27 11:02:51 +01:00
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
2025-06-04 14:32:26 +02:00
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
2025-06-04 14:32:25 +02:00
leds: lp8860: Write full EEPROM, not only half of it
2025-03-13 12:43:06 +01:00
mailbox: use error ret code of of_parse_phandle_with_args()
2025-06-04 14:32:30 +02:00
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
dm-mirror: fix a tiny race condition
2025-06-27 11:02:52 +01:00
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
2025-06-27 11:02:54 +01:00
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
2025-04-10 14:29:39 +02:00
scsi: fusion: Remove unused variable 'rc'
2024-12-14 19:44:29 +01:00
mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
2025-06-27 11:02:48 +01:00
misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
2025-05-02 07:39:25 +02:00
mmc: sdhci: Disable SD card clock before changing parameters
2025-06-04 14:32:31 +02:00
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
2025-06-27 11:02:52 +01:00
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
2025-06-27 11:02:55 +01:00
nfc: pn533: Add poll mod list filling check
2024-09-04 13:15:04 +02:00
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
nvmem: core: improve range check for nvmem_cell_write()
2025-03-13 12:43:10 +01:00
of: module: add buffer overflow check in of_modalias()
2025-06-04 14:32:25 +02:00
parport_pc: add support for ASIX AX99100
2025-03-13 12:43:19 +01:00
PCI: Fix lock symmetry in pci_slot_unlock()
2025-06-27 11:02:52 +01:00
pcmcia: Use resource_size function on resource object
2024-09-12 11:03:52 +02:00
perf: arm_pmu: Don't disable counter in armpmu_add()
2025-05-02 07:39:09 +02:00
phy: core: don't require set_mode() callback for phy_get_mode() to work
2025-06-04 14:32:33 +02:00
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
2025-06-27 11:02:55 +01:00
platform/x86: dell_rbu: Stop overwriting data buffer
2025-06-27 11:02:56 +01:00
power: supply: bq27xxx: Retrieve again when busy
2025-06-27 11:02:53 +01:00
powercap: call put_device() on an error path in powercap_register_control_type()
2025-04-10 14:29:36 +02:00
pps: Fix a use-after-free
2025-03-13 12:43:19 +01:00
ptp: Ensure info->enable callback is always set
2025-03-13 12:43:11 +01:00
pwm: mediatek: always use bus clock for PWM on MT7622
2025-05-02 07:39:18 +02:00
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
2025-06-27 11:02:56 +01:00
regulator: max14577: Add error check for max14577_read_reg()
2025-06-27 11:02:52 +01:00
reset: berlin: fix OF node leak in probe() error path
2024-11-08 16:20:28 +01:00
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
2025-06-27 11:02:48 +01:00
rtc: Fix offset calculation for .start_secs < 0
2025-06-27 11:02:48 +01:00
s390/cio: Fix CHPID "configure" attribute caching
2025-04-10 14:29:36 +02:00
scsi: lpfc: Use memcpy() for BIOS version
2025-06-27 11:02:55 +01:00
sh: clk: Fix clk_enable() to return 0 on NULL clk
2025-01-09 13:23:29 +01:00
slimbus: messaging: Free transaction ID in delayed interrupt scenario
2025-03-13 12:43:33 +01:00
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
2025-06-27 11:02:48 +01:00
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
2024-11-08 16:20:25 +01:00
spi: sh-msiof: Fix maximum DMA transfer size
2025-06-27 11:02:45 +01:00
staging: iio: ad5933: Correct settling cycles encoding per datasheet
2025-06-27 11:02:52 +01:00
scsi: target: iscsi: Fix timeout on deleted connection
2025-06-04 14:32:29 +02:00
tee: Prevent size calculation wraparound on 32-bit kernels
2025-06-27 11:02:55 +01:00
thermal/drivers/rockchip: Add missing rk3328 mapping entry
2025-05-02 07:39:16 +02:00
thunderbolt: Do not double dequeue a configuration request
2025-06-27 11:02:44 +01:00
vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
2025-06-27 11:02:48 +01:00
uio_hv_generic: Use correct size for interrupt and monitor pages
2025-06-27 11:02:52 +01:00
usb: Flush altsetting 0 endpoints before reinitializating them after reset.
2025-06-27 11:02:50 +01:00
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
2025-03-13 12:43:13 +01:00
vgacon: Add check for vc_origin address range in vgacon_scroll()
2025-06-27 11:02:51 +01:00
watchdog: da9052_wdt: respect TWDMIN
2025-06-27 11:02:55 +01:00
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
a8b5ea2e30