iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
41aeefb7e51a95a5348ee609750a7e83e1dce1e0
linux/drivers
History
Dongliang Mu b3304a6df9 usb: idmouse: fix an uninit-value in idmouse_open 
[ Upstream commit bce2b05399 ]

In idmouse_create_image, if any ftip_command fails, it will
go to the reset label. However, this leads to the data in
bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check
for valid image incurs an uninitialized dereference.

Fix this by moving the check before reset label since this
check only be valid if the data after bulk_in_buffer[HEADER]
has concrete data.

Note that this is found by KMSAN, so only kernel compilation
is tested.

Reported-by: syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20220922134847.1101921-1-dzm91@hust.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:15:48 +02:00
..
accessibility
…
acpi
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
2022-10-26 13:15:45 +02:00
amba
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-12 13:18:01 +01:00
android
binder: use wake_up_pollfree()
2021-12-14 10:04:48 +01:00
ata
ata: libata-eh: Add missing command name
2022-08-25 11:09:28 +02:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:09:29 +02:00
auxdisplay
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
2021-11-26 11:48:38 +01:00
base
driver core: Don't probe devices after bus_type.match() probe deferral
2022-09-15 12:39:46 +02:00
bcma
bcma: Fix memory leak for internally-handled cores
2021-09-22 11:43:02 +02:00
block
loop: Check for overflow while configuring loop
2022-09-05 10:23:56 +02:00
bluetooth
Bluetooth: bfusb: fix division by zero in send path
2022-01-27 08:47:30 +01:00
bus
bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
2022-05-12 12:14:55 +02:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:29:07 +02:00
char
random: use expired timer rather than wq for mixing fast pool
2022-10-26 13:15:36 +02:00
clk
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
2022-10-26 13:15:44 +02:00
clocksource
clocksource/drivers/sp804: Avoid error on multiple instances
2022-06-14 16:52:40 +02:00
connector
…
cpufreq
cpufreq: pmac32-cpufreq: Fix refcount leak bug
2022-07-21 20:40:31 +02:00
cpuidle
cpuidle: Fix kobject memory leaks in error paths
2021-11-26 11:48:33 +01:00
crypto
crypto: ccp - ccp_dmaengine_unregister release dma channels
2022-04-20 09:06:31 +02:00
dax
…
dca
…
devfreq
…
dio
…
dma
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
2022-10-26 13:15:44 +02:00
dma-buf
…
edac
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
2022-02-23 11:56:41 +01:00
eisa
…
extcon
extcon: max8997: Add missing modalias string
2021-07-20 16:21:05 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:14:57 +02:00
firmware
firmware: google: Test spinlock on panic path to avoid lockups
2022-10-26 13:15:43 +02:00
fmc
…
fpga
…
gpio
MIPS: Remove repetitive increase irq_err_count
2022-07-02 16:17:14 +02:00
gpu
drm/amdgpu: fix initial connector audio value
2022-10-26 13:15:46 +02:00
hid
HID: roccat: Fix use-after-free in roccat_read()
2022-10-26 13:15:47 +02:00
hsi
HSI: omap_ssi_port: Fix dma_map_sg error check
2022-10-26 13:15:42 +02:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 10:55:47 +02:00
hwmon
hwmon: (gpio-fan) Fix array out of bounds access
2022-09-15 12:39:44 +02:00
hwspinlock
…
hwtracing
coresight: Fix TRCCONFIGR.QE sysfs interface
2022-04-20 09:06:28 +02:00
i2c
i2c: cadence: Change large transfer count reset logic to be unconditional
2022-07-29 17:05:46 +02:00
ide
…
idle
…
iio
iio: inkern: only release the device node when done with it
2022-10-26 13:15:41 +02:00
infiniband
RDMA/rxe: Fix the error caused by qp->sk
2022-10-26 13:15:42 +02:00
input
Input: xpad - fix wireless 360 controller breaking after suspend
2022-10-26 13:15:36 +02:00
iommu
iommu/omap: Fix buffer overflow in debugfs
2022-10-26 13:15:44 +02:00
ipack
ipack: ipoctal: fix module reference leak
2021-10-06 10:23:42 +02:00
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:09:30 +02:00
isdn
mISDN: fix use-after-free bugs in l1oip timer handlers
2022-10-26 13:15:40 +02:00
leds
leds: ktd2692: Fix an error handling path
2021-07-20 16:21:05 +02:00
lguest
…
lightnvm
lightnvm: disable the subsystem
2022-05-12 12:14:53 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-25 11:09:23 +02:00
mailbox
…
mcb
mcb: fix error handling in mcb_alloc_bus()
2021-10-06 10:23:39 +02:00
md
drivers:md:fix a potential use-after-free bug
2022-08-25 11:09:31 +02:00
media
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
2022-10-26 13:15:47 +02:00
memory
memory: of: Fix refcount leak bug in of_get_ddr_timings()
2022-10-26 13:15:40 +02:00
memstick
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-26 11:48:34 +01:00
message
…
mfd
mfd: sm501: Add check for platform_driver_register()
2022-10-26 13:15:44 +02:00
misc
cxl: Fix a memory leak in an error handling path
2022-08-25 11:09:31 +02:00
mmc
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
2022-10-26 13:15:40 +02:00
mtd
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
2022-06-14 16:52:41 +02:00
net
r8152: Rate limit overflow messages
2022-10-26 13:15:46 +02:00
nfc
NFC: nxp-nci: don't print header length mismatch on i2c error
2022-07-21 20:40:32 +02:00
ntb
…
nubus
…
nvdimm
libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-03 17:44:44 +01:00
nvme
nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
2022-10-26 13:15:33 +02:00
nvmem
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-27 09:33:58 +02:00
of
fdt: Update CRC check for rng-seed
2022-07-02 16:17:16 +02:00
oprofile
…
parisc
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
2022-09-28 10:55:44 +02:00
parport
parport: remove non-zero check on count
2021-09-22 11:43:07 +02:00
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 13:15:37 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 16:52:36 +02:00
perf
…
phy
phy: samsung: exynos5250-sata: fix missing device put in probe error paths
2022-05-12 12:14:54 +02:00
pinctrl
pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
2022-08-25 11:09:29 +02:00
platform
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
2022-10-26 13:15:46 +02:00
pnp
…
power
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
2022-07-29 17:05:45 +02:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:15:45 +02:00
pps
…
ps3
powerpc/ps3: use dma_mapping_error()
2020-12-29 13:45:00 +01:00
ptp
ptp: replace snprintf with sysfs_emit
2022-04-20 09:06:42 +02:00
pwm
pwm: lp3943: Fix duty calculation in case period was clamped
2022-06-14 16:52:37 +02:00
rapidio
rapidio: handle create_workqueue() failure
2021-05-26 11:29:06 +02:00
ras
…
regulator
regulator: qcom_rpm: Fix circular deferral regression
2022-10-26 13:15:37 +02:00
remoteproc
remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
2022-04-20 09:06:36 +02:00
reset
reset: ti-syscon: fix to_ti_syscon_reset_data macro
2021-07-28 09:14:24 +02:00
rpmsg
rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
2022-06-14 16:52:37 +02:00
rtc
rtc: mt6397: check return value after calling platform_get_resource()
2022-06-14 16:52:37 +02:00
s390
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
2022-09-28 10:55:46 +02:00
sbus
…
scsi
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
2022-10-26 13:15:47 +02:00
sfi
…
sh
maple: fix wrong return value of maple_bus_init().
2021-11-26 11:48:41 +01:00
sn
…
soc
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
2022-10-26 13:15:41 +02:00
spi
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
2022-10-26 13:15:39 +02:00
spmi
…
ssb
ssb: sdio: Don't overwrite const buffer if block_write fails
2021-07-20 16:20:57 +02:00
staging
staging: rtl8712: fix use after free bugs
2022-09-15 12:39:44 +02:00
target
scsi: target: iscsi: Make sure the np under each tpg is unique
2022-02-16 12:43:53 +01:00
tc
…
thermal
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
2022-10-26 13:15:45 +02:00
thunderbolt
…
tty
serial: 8250: Fix restoring termios speed after suspend
2022-10-26 13:15:43 +02:00
uio
…
usb
usb: idmouse: fix an uninit-value in idmouse_open
2022-10-26 13:15:48 +02:00
uwb
…
vfio
vfio: Clear the caps->buf to NULL after free
2022-08-25 11:09:31 +02:00
vhost
vringh: Fix loop descriptors check in the indirect cases
2022-06-14 16:52:41 +02:00
video
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
2022-10-26 13:15:37 +02:00
virt
…
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 20:40:31 +02:00
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-20 09:06:43 +02:00
watchdog
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
2021-11-26 11:48:38 +01:00
xen
xen/xenbus: fix return type in xenbus_file_read()
2022-08-25 11:09:29 +02:00
zorro
…
Kconfig
…
Makefile
…