Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Mathias Krause a9beea8c85 Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal ... commit fbf8d71742557abaf558d8efb96742d442720cc2 upstream. Calling irq_domain_remove() will lead to freeing the IRQ domain prematurely. The domain is still referenced and will be attempted to get used via rmi_free_function_list() -> rmi_unregister_function() -> irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer. With PaX's MEMORY_SANITIZE this will lead to an access fault when attempting to dereference embedded pointers, as in Torsten's report that was faulting on the 'domain->ops->unmap' test. Fix this by releasing the IRQ domain only after all related IRQs have been deactivated. Fixes: 24d28e4f12 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com> Signed-off-by: Mathias Krause <minipli@grsecurity.net> Link: https://lore.kernel.org/r/20240222142654.856566-1-minipli@grsecurity.net Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-08 16:20:43 +01:00
..
gameport
joystick
keyboard	Input: adp5589-keys - fix adp5589_gpio_get_value()	2024-11-08 16:20:42 +01:00
misc	Input: uinput - reject requests with unreasonable number of slots	2024-09-12 11:03:55 +02:00
mouse	Input: elan_i2c - do not leave interrupt disabled on suspend failure	2024-08-19 05:33:33 +02:00
rmi4	Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal	2024-11-08 16:20:43 +01:00
serio
tablet
touchscreen	Input: silead - Always support 10 fingers	2024-07-27 10:38:29 +02:00
apm-power.c
evbug.c
evdev.c
ff-core.c	Input: ff-core - prefer struct_size over open coded arithmetic	2024-07-18 11:40:48 +02:00
ff-memless.c
input-compat.c
input-compat.h
input-leds.c
input-mt.c	Input: MT - limit max slots	2024-09-04 13:15:01 +02:00
input-polldev.c
input-poller.c
input-poller.h
input.c	Input: try trimming too long modalias strings	2024-07-05 09:08:16 +02:00
joydev.c
Kconfig
Makefile
matrix-keymap.c
mousedev.c
sparse-keymap.c