iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Peilin Ye 6af4389952 HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() 
commit 25a097f5204675550afb879ee18238ca917cba7a upstream.

`uref->usage_index` is not always being properly checked, causing
hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.

Reported-by: syzbot+34ee1b45d88571c2fa8b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03 11:21:23 +02:00
..
accessibility
…
acpi
ACPICA: Do not increment operation_region reference counts for field units
2020-08-21 11:01:59 +02:00
amba
…
android
binder: Prevent context manager from incrementing ref 0
2020-08-21 11:01:55 +02:00
ata
ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
2020-06-30 15:38:43 -04:00
atm
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
2020-08-21 11:01:55 +02:00
auxdisplay
…
base
device property: Fix the secondary firmware node handling in set_primary_fwnode()
2020-09-03 11:21:22 +02:00
bcma
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-29 10:24:31 +01:00
block
virtio-blk: free vblk-vqs in error path of virtblk_probe()
2020-07-09 09:35:56 +02:00
bluetooth
Bluetooth: btusb: fix PM leak in error case of setup
2020-01-12 11:24:16 +01:00
bus
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
2020-04-24 07:58:46 +02:00
cdrom
cdrom: respect device capabilities during opening action
2020-01-04 13:41:02 +01:00
char
agp/intel: Fix a memory leak on module initialisation failure
2020-08-21 11:01:59 +02:00
clk
clk: clk-atlas6: fix return value check in atlas6_clk_init()
2020-08-21 11:02:10 +02:00
clocksource
clocksource: dw_apb_timer_of: Fix missing clockevent timers
2020-06-20 10:24:14 +02:00
connector
…
cpufreq
cpufreq: powernv: Fix use-after-free
2020-04-24 07:58:59 +02:00
cpuidle
cpuidle: Fix three reference count leaks
2020-06-20 10:24:18 +02:00
crypto
crypto: ccp - Fix use of merged scatterlists
2020-08-21 11:02:05 +02:00
dax
…
dca
…
devfreq
PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
2020-02-28 15:42:28 +01:00
dio
…
dma
dmaengine: ioat setting ioat timeout as module parameter
2020-07-31 16:44:03 +02:00
dma-buf
dma-buf: Fix memory leak in sync_file_merge()
2019-12-21 10:42:32 +01:00
edac
EDAC/ie31200: Fallback if host bridge device is already initialized
2020-09-03 11:21:18 +02:00
eisa
…
extcon
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-30 15:38:28 -04:00
firewire
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
firmware
efi: Make it possible to disable efivar_ssdt entirely
2020-07-09 09:35:57 +02:00
fmc
…
fpga
…
gpio
gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...)
2020-08-21 11:01:56 +02:00
gpu
drm/nouveau: Fix reference count leak in nouveau_connector_detect
2020-09-03 11:21:17 +02:00
hid
HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
2020-09-03 11:21:23 +02:00
hsi
…
hv
…
hwmon
hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
2020-07-22 09:10:53 +02:00
hwspinlock
…
hwtracing
intel_th: Fix user-visible error codes
2020-04-02 17:20:25 +02:00
i2c
i2c: rcar: in slave mode, clear NACK earlier
2020-09-03 11:21:19 +02:00
ide
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-28 15:42:36 +01:00
idle
…
iio
iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
2020-08-21 11:02:07 +02:00
infiniband
RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
2020-06-30 15:38:42 -04:00
input
Input: psmouse - add a newline when printing 'proto' by sysfs
2020-08-26 10:29:04 +02:00
iommu
iommu/iova: Don't BUG on invalid PFNs
2020-09-03 11:21:16 +02:00
ipack
…
irqchip
irqchip/gic: Atomically update affinity
2020-07-22 09:10:54 +02:00
isdn
staging: gigaset: add endpoint-type sanity check
2019-12-21 10:41:50 +01:00
leds
leds: core: Flush scheduled work for system suspend
2020-08-21 11:02:01 +02:00
lguest
…
lightnvm
…
macintosh
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-20 10:24:21 +02:00
mailbox
mailbox: handle failed named mailbox channel request
2019-08-04 09:33:41 +02:00
mcb
…
md
overflow.h: Add allocation size calculation helpers
2020-09-03 11:21:22 +02:00
media
media: davinci: vpif_capture: fix potential double free
2020-09-03 11:21:18 +02:00
memory
…
memstick
memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
2019-10-29 09:15:25 +01:00
message
scsi: mptscsih: Fix read sense data size
2020-07-22 09:10:45 +02:00
mfd
mfd: dln2: Run event handler loop under spinlock
2020-08-21 11:02:11 +02:00
misc
cxl: Fix kobject memleak
2020-08-21 11:02:00 +02:00
mmc
mmc: sdhci-esdhc-imx: fix the mask for tuning start point
2020-06-20 10:24:18 +02:00
mtd
mtd: properly check all write ioctls for permissions
2020-08-21 11:01:54 +02:00
net
net: gianfar: Add of_node_put() before goto statement
2020-09-03 11:21:20 +02:00
nfc
nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
2020-08-21 11:01:51 +02:00
ntb
ntb: intel: fix return value for ndev_vec_mask()
2019-11-28 18:28:52 +01:00
nubus
…
nvdimm
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
2020-05-27 16:42:00 +02:00
nvme
nvme: retain split access workaround for capability reads
2020-01-29 10:24:33 +01:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-06-11 09:22:22 +02:00
of
of: unittest: kmemleak in of_unittest_platform_populate()
2020-04-24 07:59:10 +02:00
oprofile
…
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-21 11:02:06 +02:00
parport
parport: load lowlevel driver if ports not found
2020-01-04 13:39:55 +01:00
pci
PCI: Fix pci_create_slot() reference count leak
2020-09-03 11:21:17 +02:00
pcmcia
…
perf
drivers/perf: arm_pmu: Fix failure path in PM notifier
2019-08-06 18:29:41 +02:00
phy
phy: phy-twl4030-usb: fix denied runtime access
2019-11-25 09:52:50 +01:00
pinctrl
pinctrl-single: fix pcs_parse_pinconf() return value
2020-08-21 11:02:04 +02:00
platform
platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
2020-08-21 11:01:57 +02:00
pnp
…
power
power: supply: check if calc_soc succeeded in pm860x_init_battery
2020-08-21 11:02:03 +02:00
powercap
…
pps
drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
2019-08-04 09:33:45 +02:00
ps3
…
ptp
ptp: free ptp device pin descriptors properly
2020-05-20 08:15:33 +02:00
pwm
pwm: bcm-iproc: handle clk_get_rate() return
2020-08-21 11:02:10 +02:00
rapidio
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 16:42:02 +02:00
ras
…
regulator
regulator: rk808: Lower log level on optional GPIOs being not available
2020-02-28 15:42:23 +01:00
remoteproc
remoteproc: Fix wrong rvring index computation
2020-05-02 17:23:14 +02:00
reset
reset: Fix potential use-after-free in __of_reset_control_get()
2019-11-25 09:53:42 +01:00
rpmsg
…
rtc
rtc: pm8xxx: Fix issue in RTC write path
2020-04-24 07:59:09 +02:00
s390
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-03 11:21:19 +02:00
sbus
…
scsi
scsi: ufs: Improve interrupt handling for shared interrupts
2020-09-03 11:21:20 +02:00
sfi
…
sh
…
sn
…
soc
soc: qcom: smem: Use le32_to_cpu for comparison
2020-04-24 07:59:10 +02:00
spi
spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
2020-07-22 09:10:50 +02:00
spmi
…
ssb
…
staging
cec-api: prevent leaking memory through hole in structure
2020-09-03 11:21:17 +02:00
target
scsi: target: tcmu: Fix crash on ARM during cmd completion
2020-09-03 11:21:16 +02:00
tc
…
thermal
Revert "thermal: mediatek: fix register index error"
2020-07-22 09:10:51 +02:00
thunderbolt
thunderbolt: Use 32-bit writes when writing ring producer/consumer
2019-11-06 12:18:14 +01:00
tty
serial: 8250: change lock order in serial8250_do_startup()
2020-09-03 11:21:21 +02:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb
usb: storage: Add unusual_uas entry for Sony PSZ drives
2020-09-03 11:21:23 +02:00
uwb
…
vfio
vfio-pci: Mask cap zero
2020-06-30 15:38:25 -04:00
vhost
vhost: vsock: kick send_pkt worker once device is started
2020-05-10 10:28:00 +02:00
video
fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-03 11:21:20 +02:00
virt
…
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:29:05 +02:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-28 15:42:33 +01:00
w1
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-20 10:24:22 +02:00
watchdog
watchdog: f71808e_wdt: clear watchdog timeout occurred flag
2020-08-21 11:02:09 +02:00
xen
XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-03 11:21:21 +02:00
zorro
…
Kconfig
…
Makefile
…