Dan Carpenter
84fff8e6f1
dmaengine: nbpfaxi: Fix memory corruption in probe() ...
commit 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 upstream.
The nbpf->chan[] array is allocated earlier in the nbpf_probe() function
and it has "num_channels" elements. These three loops iterate one
element farther than they should and corrupt memory.
The changes to the second loop are more involved. In this case, we're
copying data from the irqbuf[] array into the nbpf->chan[] array. If
the data in irqbuf[i] is the error IRQ then we skip it, so the iterators
are not in sync. I added a check to ensure that we don't go beyond the
end of the irqbuf[] array. I'm pretty sure this can't happen, but it
seemed harmless to add a check.
On the other hand, after the loop has ended there is a check to ensure
that the "chan" iterator is where we expect it to be. In the original
code we went one element beyond the end of the array so the iterator
wasn't in the correct place and it would always return -EINVAL. However,
now it will always be in the correct place. I deleted the check since
we know the result.
Cc: stable@vger.kernel.org
Fixes: b45b262cefhttps://lore.kernel.org/r/b13c5225-7eff-448c-badc-a2c98e9bcaca@sabinyo.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:15 +02:00
Revert "ACPI: battery: negate current when discharging"
2025-07-17 18:25:03 +02:00
binder: fix UAF caused by offsets overwrite
2024-09-12 11:03:55 +02:00
ata: pata_cs5536: fix build on 32-bit UML
2025-07-17 18:24:57 +02:00
atm: idt77252: Add missing dma_map_error()
2025-07-17 18:25:05 +02:00
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
2025-06-27 11:02:53 +01:00
aoe: clean device rq_list in aoedev_downdev()
2025-06-27 11:02:57 +01:00
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
2025-06-27 11:02:55 +01:00
virtio_console: fix missing byte order handling for cols and rows
2025-05-02 07:39:26 +02:00
clk: rockchip: rk3036: mark ddrphy as critical
2025-06-27 11:02:55 +01:00
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
2025-06-04 14:32:29 +02:00
counter: stm32-lptimer-cnt: fix error handling when enabling
2025-04-10 14:29:39 +02:00
cpufreq: Force sync policy boost with global boost on sysfs update
2025-06-27 11:02:54 +01:00
cpuidle: menu: Avoid discarding useful information
2025-06-04 14:32:32 +02:00
crypto: marvell/cesa - Avoid empty transfer descriptor
2025-06-27 11:02:45 +01:00
dmaengine: nbpfaxi: Fix memory corruption in probe()
2025-08-28 16:21:15 +02:00
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
2025-07-17 18:25:04 +02:00
EDAC/altera: Use correct write width with the INTTEST register
2025-06-27 11:02:51 +01:00
firmware: psci: Fix refcount leak in psci_dt_init
2025-06-27 11:02:46 +01:00
fpga: altera-cvp: Increase credit timeout
2025-06-04 14:32:32 +02:00
gpio: zynq: Fix wakeup source leaks on device unbind
2025-05-02 07:39:17 +02:00
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
2025-07-17 18:25:01 +02:00
HID: core: do not bypass hid_hw_raw_request
2025-08-28 16:21:14 +02:00
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
2025-04-10 14:29:35 +02:00
hwmon: (occ) fix unaligned accesses
2025-06-27 11:02:57 +01:00
coresight: catu: Fix number of pages while using 64k pages
2025-04-10 14:29:41 +02:00
i2c: stm32: fix the device used for the DMA map
2025-08-28 16:21:14 +02:00
i3c: Add NULL pointer check in i3c_master_queue_ibi()
2025-05-02 07:39:15 +02:00
iio: pressure: zpa2326: Use aligned_s64 for the timestamp
2025-07-17 18:24:50 +02:00
RDMA/mlx5: Fix vport loopback for MPV device
2025-07-17 18:25:03 +02:00
Input: xpad - set correct controller type for Acer NGR200
2025-08-28 16:21:14 +02:00
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
2025-06-04 14:32:26 +02:00
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
2025-06-04 14:32:25 +02:00
leds: lp8860: Write full EEPROM, not only half of it
2025-03-13 12:43:06 +01:00
mailbox: Not protect module_put with spin_lock_irqsave
2025-07-17 18:24:49 +02:00
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
md/raid1: Fix stack memory use after return in raid1_reshape
2025-07-17 18:25:04 +02:00
media: uvcvideo: Rollback non processed entities on error
2025-07-17 18:25:01 +02:00
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
2025-04-10 14:29:39 +02:00
scsi: fusion: Remove unused variable 'rc'
2024-12-14 19:44:29 +01:00
mfd: max14577: Fix wakeup source leaks on device unbind
2025-07-17 18:24:49 +02:00
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
2025-07-17 18:24:51 +02:00
mtk-sd: reset host->mrq on prepare_data() error
2025-07-17 18:24:58 +02:00
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
2025-06-27 11:02:52 +01:00
net: usb: qmi_wwan: add SIMCom 8230C composition
2025-07-17 18:25:05 +02:00
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
nvmem: core: improve range check for nvmem_cell_write()
2025-03-13 12:43:10 +01:00
of: module: add buffer overflow check in of_modalias()
2025-06-04 14:32:25 +02:00
parport_pc: add support for ASIX AX99100
2025-03-13 12:43:19 +01:00
PCI: Fix lock symmetry in pci_slot_unlock()
2025-06-27 11:02:52 +01:00
perf: arm_pmu: Don't disable counter in armpmu_add()
2025-05-02 07:39:09 +02:00
phy: core: don't require set_mode() callback for phy_get_mode() to work
2025-06-04 14:32:33 +02:00
pinctrl: qcom: msm: mark certain pins as invalid for interrupts
2025-07-17 18:25:03 +02:00
platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
2025-07-17 18:24:56 +02:00
power: supply: bq27xxx: Retrieve again when busy
2025-06-27 11:02:53 +01:00
powercap: call put_device() on an error path in powercap_register_control_type()
2025-04-10 14:29:36 +02:00
pps: Fix a use-after-free
2025-03-13 12:43:19 +01:00
ptp: Ensure info->enable callback is always set
2025-03-13 12:43:11 +01:00
pwm: mediatek: Ensure to disable clocks in error path
2025-07-17 18:25:03 +02:00
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
2025-06-27 11:02:56 +01:00
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
2025-07-17 18:24:58 +02:00
reset: berlin: fix OF node leak in probe() error path
2024-11-08 16:20:28 +01:00
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
2025-06-27 11:02:48 +01:00
rtc: test: Fix invalid format specifier.
2025-06-27 11:02:58 +01:00
scsi: s390: zfcp: Ensure synchronous unit_add
2025-06-27 11:02:56 +01:00
scsi: ufs: core: Fix spelling of a sysfs attribute name
2025-07-17 18:24:58 +02:00
sh: clk: Fix clk_enable() to return 0 on NULL clk
2025-01-09 13:23:29 +01:00
slimbus: messaging: Free transaction ID in delayed interrupt scenario
2025-03-13 12:43:33 +01:00
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
2025-06-27 11:02:48 +01:00
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
2024-11-08 16:20:25 +01:00
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
2025-07-17 18:25:00 +02:00
staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
2025-07-17 18:25:01 +02:00
scsi: target: iscsi: Fix timeout on deleted connection
2025-06-04 14:32:29 +02:00
tee: Prevent size calculation wraparound on 32-bit kernels
2025-06-27 11:02:55 +01:00
thermal/drivers/rockchip: Add missing rk3328 mapping entry
2025-05-02 07:39:16 +02:00
thunderbolt: Do not double dequeue a configuration request
2025-06-27 11:02:44 +01:00
pch_uart: Fix dma_sync_sg_for_device() nents value
2025-08-28 16:21:14 +02:00
uio_hv_generic: Use correct size for interrupt and monitor pages
2025-06-27 11:02:52 +01:00
usb: gadget: configfs: Fix OOB read on empty string write
2025-08-28 16:21:13 +02:00
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
2025-03-13 12:43:13 +01:00
vgacon: Add check for vc_origin address range in vgacon_scroll()
2025-06-27 11:02:51 +01:00
watchdog: da9052_wdt: respect TWDMIN
2025-06-27 11:02:55 +01:00
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
84fff8e6f1