Kees Cook
da4e715a46
USB: ene_usb6250: Allocate enough memory for full object ...
[ Upstream commit ce33e64c1788912976b61314b56935abd4bc97ef ]
The allocation of PageBuffer is 512 bytes in size, but the dereferencing
of struct ms_bootblock_idi (also size 512) happens at a calculated offset
within the allocation, which means the object could potentially extend
beyond the end of the allocation. Avoid this case by just allocating
enough space to catch any accesses beyond the end. Seen with GCC 13:
../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock':
../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=]
1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF)
| ^~
../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu'
1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF)
| ^~~~~~~~~~~
In file included from ../drivers/usb/storage/ene_ub6250.c:5:
In function 'kmalloc',
inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15:
../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace'
580 | return kmalloc_trace(
| ^~~~~~~~~~~~~~
581 | kmalloc_caches[kmalloc_type(flags)][index],
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
582 | flags, size);
| ~~~~~~~~~~~~
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-11 16:44:15 +01:00
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
2023-03-11 16:43:56 +01:00
binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
2022-12-08 11:23:01 +01:00
ata: libata: Fix sata_down_spd_limit() when no link speed is reported
2023-02-22 12:50:24 +01:00
driver core: Fix test_async_probe_init saves device in wrong array
2023-02-06 07:52:40 +01:00
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
2023-03-11 16:44:04 +01:00
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:16 +01:00
bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
2023-02-22 12:50:23 +01:00
ipmi_ssif: Rename idle state and check
2023-03-11 16:43:58 +01:00
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
2023-03-11 16:43:51 +01:00
clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
2023-01-18 11:40:56 +01:00
counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
2023-01-18 11:41:24 +01:00
cpufreq: armada-37xx: stop using 0 as NULL pointer
2023-02-06 07:52:41 +01:00
cpuidle: dt: Return the correct numbers of parsed idle states
2023-01-18 11:40:53 +01:00
crypto: crypto4xx - Call dma_unmap_page when done
2023-03-11 16:43:42 +01:00
PM/devfreq: governor: Add a private governor_data for governor
2023-01-18 11:41:52 +01:00
drivers: dio: fix possible memory leak in dio_init()
2023-01-18 11:41:21 +01:00
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
2023-03-03 11:41:48 +01:00
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
2023-02-06 07:52:44 +01:00
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
2023-02-22 12:50:22 +01:00
firmware: coreboot: framebuffer: Ignore reserved pixel color bits
2023-03-11 16:43:58 +01:00
fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
2023-02-22 12:50:28 +01:00
WRITE is "data source", not destination...
2023-02-22 12:50:23 +01:00
gpio: vf610: connect GPIO label to dev name
2023-03-11 16:43:47 +01:00
drm/radeon: Fix eDP for single-display iMac11,2
2023-03-11 16:44:07 +01:00
HID: Add Mapping for System Microphone Mute
2023-03-11 16:43:56 +01:00
HSI: omap_ssi_core: Fix error handling in ssi_init()
2023-01-18 11:41:28 +01:00
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
2022-12-08 11:22:58 +01:00
hwmon: (coretemp) Simplify platform device handling
2023-03-11 16:43:57 +01:00
i2c: rk3x: fix a bunch of kernel-doc warnings
2023-02-22 12:50:25 +01:00
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
2023-03-11 16:44:15 +01:00
IB/hfi1: Assign npages earlier
2023-03-03 11:41:48 +01:00
Input: ads7846 - don't check penirq immediately for 7845
2023-03-11 16:43:51 +01:00
iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map()
2023-02-22 12:50:42 +01:00
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
2023-03-11 16:43:43 +01:00
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:32 +01:00
macintosh/macio-adb: check the return value of ioremap()
2023-01-18 11:41:29 +01:00
mailbox: zynq-ipi: fix error handling while device_register() fails
2023-01-18 11:41:33 +01:00
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
2023-01-18 11:41:25 +01:00
dm flakey: don't corrupt the zero page
2023-03-11 16:44:04 +01:00
media: uvcvideo: Silence memcpy() run-time false positive warnings
2023-03-11 16:44:14 +01:00
memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
2023-02-06 07:52:34 +01:00
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
2023-03-11 16:44:13 +01:00
mei: bus-fixup:upon error print return values of send and receive
2023-03-11 16:44:14 +01:00
mmc: mmc_spi: fix error handling in mmc_spi_probe()
2023-02-22 12:50:39 +01:00
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
2023-03-11 16:44:10 +01:00
net/mlx5: Geneve, Fix handling of Geneve object id as error code
2023-03-11 16:44:12 +01:00
nfc: fix memory leak of se_io context in nfc_genl_se_io
2023-03-11 16:44:12 +01:00
nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
2023-02-22 12:50:35 +01:00
nvmem: core: fix cell removal on error
2023-02-22 12:50:28 +01:00
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
2023-01-18 11:41:14 +01:00
OPP: fix error checking in opp_migrate_dentry()
2023-03-11 16:43:41 +01:00
parisc: led: Fix potential null-ptr-deref in start_task()
2023-01-18 11:41:50 +01:00
parport_pc: Avoid FIFO port location truncation
2022-11-25 17:42:14 +01:00
PCI: Avoid FLR for AMD FCH AHCI adapters
2023-03-11 16:44:07 +01:00
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
2023-01-18 11:40:50 +01:00
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
2023-02-06 07:52:37 +01:00
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
2023-03-11 16:43:57 +01:00
platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
2023-02-06 07:52:42 +01:00
PNP: fix name memory leak in pnp_alloc_dev()
2023-01-18 11:40:54 +01:00
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
2023-01-18 11:41:28 +01:00
powercap: fix possible name leak in powercap_register_zone()
2023-03-11 16:43:40 +01:00
pwm: stm32-lp: fix the check on arr and cmp registers update
2023-03-11 16:44:08 +01:00
rapidio: devices: fix missing put_device in mport_cdev_open
2023-01-18 11:40:59 +01:00
regulator: s5m8767: Bounds check id indexing into arrays
2023-03-11 16:43:57 +01:00
remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
2023-03-11 16:43:52 +01:00
rpmsg: glink: Avoid infinite loop on intent for missing channel
2023-03-11 16:43:53 +01:00
rtc: sun6i: Always export the internal oscillator
2023-03-11 16:44:13 +01:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-03-11 16:43:42 +01:00
scsi: ipr: Work around fortify-string warning
2023-03-11 16:44:13 +01:00
slimbus: stream: correct presence rate frequencies
2022-11-25 17:42:17 +01:00
ARM: ux500: do not directly dereference __iomem
2023-01-18 11:41:46 +01:00
spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
2023-03-11 16:43:47 +01:00
staging: emxx_udc: Add checks for dma_alloc_coherent()
2023-03-11 16:44:14 +01:00
scsi: target: core: Fix warning on RT kernels
2023-02-22 12:50:25 +01:00
tee: optee: fix possible memory leak in optee_register_device()
2022-12-08 11:22:57 +01:00
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
2023-03-11 16:44:13 +01:00
tty: serial: fsl_lpuart: disable the CTS when send break signal
2023-03-11 16:44:14 +01:00
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
2023-01-18 11:41:22 +01:00
USB: ene_usb6250: Allocate enough memory for full object
2023-03-11 16:44:15 +01:00
vfio: platform: Do not pass return buffer to ACPI _RST method
2023-01-18 11:41:22 +01:00
vhost: fix range used in translate_desc()
2023-01-18 11:41:57 +01:00
fbdev: smscufx: fix error handling code in ufx_usb_probe
2023-02-22 12:50:29 +01:00
vme: Fix error not catched in fake_init()
2023-01-18 11:41:26 +01:00
w1: fix WARNING after calling w1_process()
2023-02-06 07:52:40 +01:00
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
2023-03-11 16:44:11 +01:00
fix "direction" argument of iov_iter_kvec()
2023-02-22 12:50:23 +01:00
da4e715a46