Johan Hovold
d2c64ebcc7
net: lan78xx: fix division by zero in send path ...
commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in lan78xx_tx_bh() in case a malicious device has
broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).
Fixes: 55d7de9de6stable@vger.kernel.org # 4.3
Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-02 19:46:13 +01:00
acpi/arm64: fix next_platform_timer() section mismatch error
2021-10-20 11:40:17 +02:00
binder: make sure fd closes complete
2021-09-30 10:09:21 +02:00
ata: sata_mv: Fix the error handling of mv_chip_id()
2021-11-02 19:46:12 +01:00
atm: nicstar: register the interrupt handler in the right place
2021-07-19 08:53:12 +02:00
PM: base: power: don't try to use non-existing RTC for storing data
2021-09-22 12:26:39 +02:00
bcma: Fix memory leak for internally-handled cores
2021-09-15 09:47:37 +02:00
Revert "block: nbd: add sanity check for first_minor"
2021-09-16 12:56:13 +02:00
Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
2021-07-19 08:53:13 +02:00
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
2021-10-13 10:08:19 +02:00
cdrom: gdrom: initialize global variable at init time
2021-05-26 12:05:19 +02:00
tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
2021-08-12 13:21:01 +02:00
clk: at91: clk-generated: Limit the requested rate to our range
2021-09-22 12:26:25 +02:00
clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
2021-09-15 09:47:29 +02:00
counter: 104-quad-8: Return error when invalid mode during ceiling_write
2021-09-15 09:47:34 +02:00
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
2021-10-06 15:42:30 +02:00
crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
2021-10-06 15:42:39 +02:00
PM / devfreq: Use more accurate returned new_freq as resume_freq
2021-05-14 09:44:20 +02:00
dmaengine: xilinx_dma: Set DMA mask for coherent APIs
2021-09-26 14:07:11 +02:00
dma-buf/sync_file: Don't leak fences on merge failure
2021-07-25 14:35:15 +02:00
EDAC/armada-xp: Fix output of uncorrectable error counter
2021-10-20 11:40:14 +02:00
extcon: intel-mrfld: Sync hardware and software state on init
2021-07-19 08:53:16 +02:00
efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
2021-10-20 11:40:14 +02:00
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
2021-09-30 10:09:23 +02:00
fsi/sbefifo: Fix reset timeout
2021-07-14 16:53:42 +02:00
gpio: pca953x: Improve bias setting
2021-10-20 11:40:15 +02:00
drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
2021-10-20 11:40:17 +02:00
HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
2021-10-17 10:42:33 +02:00
HSI: core: fix resource leaks in hsi_add_client_from_dt()
2021-05-14 09:44:25 +02:00
hv_utils: Fix passing zero to 'PTR_ERR' warning
2021-07-14 16:53:16 +02:00
hwmon: (tmp421) fix rounding for negative values
2021-10-06 15:42:33 +02:00
intel_th: Wait until port is in reset before programming it
2021-07-20 16:10:46 +02:00
i2c: acpi: fix resource leak in reconfiguration device addition
2021-10-13 10:08:20 +02:00
Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
2021-05-14 09:44:15 +02:00
iio: dac: ti-dac5571: fix an error code in probe()
2021-10-20 11:40:15 +02:00
RDMA/efa: Remove double QP type assignment
2021-09-22 12:26:23 +02:00
Input: snvs_pwrkey - add clk handling
2021-10-27 09:54:29 +02:00
iommu: Check if group is NULL before remove device
2021-08-26 08:36:15 -04:00
ipack: ipoctal: fix module reference leak
2021-10-06 15:42:36 +02:00
irqchip/gic-v3-its: Fix potential VPE leak on error
2021-09-30 10:09:24 +02:00
isdn: mISDN: Fix sleeping function called from invalid context
2021-10-27 09:54:29 +02:00
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
2021-09-15 09:47:33 +02:00
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:09:22 +02:00
md: fix a lock order reversal in md_alloc
2021-09-30 10:09:24 +02:00
media: tegra-cec: Handle errors of clk_prepare_enable()
2021-09-22 12:26:31 +02:00
memory: fsl_ifc: fix leak of private memory on probe failure
2021-07-20 16:10:52 +02:00
memstick: rtsx_usb_ms: fix UAF
2021-07-14 16:53:13 +02:00
mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
2021-09-22 12:26:44 +02:00
cb710: avoid NULL pointer subtraction
2021-10-20 11:40:13 +02:00
mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit
2021-11-02 19:46:12 +01:00
mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
2021-09-22 12:26:45 +02:00
net: lan78xx: fix division by zero in send path
2021-11-02 19:46:13 +01:00
nfc: port100: fix using -ERRNO as command type mask
2021-11-02 19:46:12 +01:00
NTB: perf: Fix an error code in perf_setup_inbuf()
2021-09-22 12:26:44 +02:00
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
2021-10-06 15:42:38 +02:00
nvme-multipath: fix ANA state updates when a namespace is not present
2021-09-30 10:09:25 +02:00
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-20 11:40:14 +02:00
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
2021-09-22 12:26:34 +02:00
opp: Don't print an error if required-opps is missing
2021-09-22 12:26:33 +02:00
parisc: Move pci_dev_is_behind_card_dino to where it is used
2021-09-26 14:07:10 +02:00
parport: remove non-zero check on count
2021-09-22 12:26:36 +02:00
PCI: Fix pci_host_bridge struct device release/free handling
2021-10-06 15:42:38 +02:00
pcmcia: i82092: fix a null pointer dereference bug
2021-08-12 13:21:03 +02:00
drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe()
2021-07-14 16:53:14 +02:00
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
2021-07-14 16:53:46 +02:00
Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode"
2021-11-02 19:46:12 +01:00
platform/x86: intel_scu_ipc: Update timeout value in comment
2021-10-27 09:54:29 +02:00
power: supply: max17042: handle fails of reading status register
2021-09-22 12:26:21 +02:00
ptp_pch: Load module automatically if ID matches
2021-10-13 10:08:19 +02:00
pwm: stm32-lp: Don't modify HW state in .remove() callback
2021-09-26 14:07:13 +02:00
rapidio: handle create_workqueue() failure
2021-05-26 12:05:17 +02:00
regulator: vctrl: Avoid lockdep warning in enable/disable ops
2021-09-15 09:47:29 +02:00
reset: reset-zynqmp: Fixed the argument data type
2021-09-12 08:56:39 +02:00
rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
2021-05-19 10:08:25 +02:00
rtc: rx8010: select REGMAP_I2C
2021-09-26 14:07:14 +02:00
s390/sclp: fix Secure-IPL facility detection
2021-09-22 12:26:40 +02:00
scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
2021-10-27 09:54:29 +02:00
slimbus: ngd: reset dma setup during runtime pm
2021-08-26 08:36:21 -04:00
soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
2021-10-13 10:08:18 +02:00
soundwire: stream: Fix test for DP prepare complete
2021-07-14 16:53:45 +02:00
spi: Fix tegra20 build with CONFIG_PM=n
2021-09-30 10:09:26 +02:00
ssb: Fix error return code in ssb_bus_scan()
2021-07-14 16:53:29 +02:00
staging: greybus: uart: fix tty use after free
2021-09-30 10:09:21 +02:00
scsi: target: avoid per-loop XCOPY buffer allocations
2021-09-22 12:26:25 +02:00
tee: optee: Fix missing devices unregister during optee_remove
2021-10-27 09:54:25 +02:00
thermal/drivers/int340x: Do not set a wrong tcc offset on resume
2021-09-30 10:09:26 +02:00
thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
2021-06-03 08:59:03 +02:00
tty: Fix out-of-bound vmalloc access in imageblit
2021-10-06 15:42:29 +02:00
uio_hv_generic: Fix a memory leak in error handling paths
2021-05-26 12:05:17 +02:00
USB: serial: option: add prod. id for Quectel EG91
2021-10-20 11:40:14 +02:00
vfio: Use config not menuconfig for VFIO_NOIOMMU
2021-09-22 12:26:23 +02:00
vhost_net: fix OoB on sendmsg() failure.
2021-09-22 12:26:41 +02:00
video: fbdev: gbefb: Only instantiate device when built for IP32
2021-10-13 10:08:19 +02:00
virtio: write back F_VERSION_1 before validate
2021-10-20 11:40:14 +02:00
visorbus: fix error return code in visorchipset_init()
2021-07-14 16:53:42 +02:00
w1: ds2438: fixing bug that would always get page0
2021-07-20 16:10:41 +02:00
watchdog: orion: use 0 for unset heartbeat
2021-10-20 11:40:13 +02:00
xen/balloon: fix cancelled balloon action
2021-10-13 10:08:17 +02:00
d2c64ebcc7