iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Ning Qiang 224b653547 macintosh/adb: fix oob read in do_adb_query() function 
commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream.

In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied
form userland. The parameter "req->data[2]" is missing check, the array
size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and
adb_handler[req->data[2]].handler_id will lead to oob read.

Cc: stable <stable@kernel.org>
Signed-off-by: Ning Qiang <sohu0106@126.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:22:05 +02:00
..
accessibility
Revert "speakup: Generate speakupmap.h automatically"
2022-05-20 21:07:05 +02:00
acpi
ACPI: APEI: Better fix to avoid spamming the console with old error logs
2022-08-11 13:22:03 +02:00
amba
ARM: 9207/1: amba: fix refcount underflow if amba_device_add() fails
2022-07-14 13:17:48 +01:00
android
fix for breakage in #work.fd this window
2022-06-05 17:14:03 -07:00
ata
ata: sata_mv: Fixes expected number of resources now IRQs are gone
2022-08-11 13:22:03 +02:00
atm
…
auxdisplay
…
base
Just when you thought that all the speculation bugs were addressed and
2022-07-11 18:15:25 -07:00
bcma
bcma: gpio: Switch to use fwnode instead of of_node
2022-05-09 14:41:43 +03:00
block
xen/blkfront: force data bouncing when backend is untrusted
2022-07-01 10:00:50 +02:00
bluetooth
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586
2022-08-11 13:22:05 +02:00
bus
ARM: SoC fixes for 5.19
2022-06-26 14:12:56 -07:00
cdrom
cdrom: remove obsolete TODO list
2022-05-15 18:31:28 -06:00
char
random: cap jitter samples per bit to factor of HZ
2022-07-16 10:42:12 -07:00
clk
clk: sunxi-ng: Fix H6 RTC clock definition
2022-07-27 16:45:58 -07:00
clocksource
clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()
2022-06-08 12:27:08 +00:00
comedi
comedi: vmk80xx: fix expression for tx buffer size
2022-06-10 15:21:23 +02:00
connector
…
counter
…
cpufreq
cpufreq arm fixes for 5.19-rc6
2022-07-15 13:54:14 +02:00
cpuidle
Merge branches 'pm-em' and 'pm-cpuidle'
2022-05-23 19:18:51 +02:00
crypto
crypto: s390 - do not depend on CRYPTO_HW for SIMD implementations
2022-07-06 20:04:06 -07:00
cxl
cxl/mbox: Fix missing variable payload checks in cmd size validation
2022-06-28 22:03:18 -07:00
dax
dax: add .recovery_write dax_operation
2022-05-16 13:37:59 -07:00
dca
…
devfreq
PM / devfreq: exynos-bus: Fix NULL pointer dereference
2022-07-08 04:32:26 +09:00
dio
drivers: dio: add missing iounmap() in dio_init()
2022-05-19 18:56:51 +02:00
dma
dmaengine: lgm: Fix an error handling path in intel_ldma_probe()
2022-07-06 10:53:25 +05:30
dma-buf
Three mode setting fixes for fsl-ldb, a fbdev removal use-after-free fix,
2022-07-12 10:44:40 +10:00
edac
EDAC/ghes: Set the DIMM label unconditionally
2022-07-27 10:42:52 +02:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-05-13 17:03:41 +09:00
firewire
firewire: convert sysfs sprintf/snprintf family to sysfs_emit
2022-06-17 10:43:20 +02:00
firmware
platform-drivers-x86 for v5.19-4
2022-07-15 10:12:22 -07:00
fpga
fpga: dfl: Allow Port to be linked to FME's DFL
2022-05-10 16:05:38 +08:00
fsi
…
gnss
…
gpio
gpio fixes for v5.19-rc8
2022-07-22 12:28:47 -07:00
gpu
drm fixes for 5.19 final (part 2)
2022-07-29 13:25:31 -07:00
greybus
…
hid
HID: hyperv: Correctly access fields declared as __le16
2022-06-08 12:28:13 +00:00
hsi
…
hte
hte: Uninitialized variable in hte_ts_get()
2022-05-20 15:54:41 +02:00
hv
Drivers: hv: vmbus: Release cpu lock in error case
2022-06-10 08:41:28 +00:00
hwmon
hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails
2022-07-01 11:53:29 -07:00
hwspinlock
…
hwtracing
coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
2022-05-09 16:03:24 +01:00
i2c
i2c: cadence: Change large transfer count reset logic to be unconditional
2022-07-16 14:44:12 +02:00
i3c
i3c: master: svc: fix returnvar.cocci warning
2022-05-17 22:34:42 +02:00
idle
intel_idle: Fix false positive RCU splats due to incorrect hardirqs state
2022-07-25 19:39:07 +02:00
iio
1st set of IIO fixes for the 5.19 cycle.
2022-06-20 09:49:52 +02:00
infiniband
RDMA/irdma: Fix sleep from invalid context BUG
2022-07-11 03:04:16 -03:00
input
Input updates for v5.19-rc6
2022-07-17 07:52:46 -07:00
interconnect
Char / Misc / Other smaller driver subsystem updates for 5.19-rc1
2022-06-03 11:36:34 -07:00
iommu
iommu/vt-d: Fix RID2PASID setup/teardown failure
2022-07-06 12:59:21 +02:00
ipack
…
irqchip
IRQ urgent fixes by way of Marc Zygnier:
2022-07-10 08:52:12 -07:00
isdn
…
leds
ARM: multiplatform changes, part 2
2022-06-02 15:23:54 -07:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 13:22:05 +02:00
mailbox
mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n
2022-05-24 08:08:24 -05:00
mcb
…
md
block-5.19-2022-07-21
2022-07-22 12:41:14 -07:00
media
USB / Thunderbolt changes for 5.19-rc1
2022-06-03 11:17:49 -07:00
memory
memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
2022-06-06 11:18:20 +02:00
memstick
…
message
…
mfd
ARM: multiplatform changes, part 2
2022-06-02 15:23:54 -07:00
misc
lkdtm: Disable return thunks in rodata.c
2022-07-20 19:24:53 +02:00
mmc
mmc: sdhci-omap: Fix a lockdep warning for PM runtime init
2022-07-13 12:29:17 +02:00
most
…
mtd
mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
2022-07-15 17:41:11 +02:00
mux
…
net
stmmac: dwmac-mediatek: fix resource leak in probe
2022-07-28 10:43:04 -07:00
nfc
NFC: nxp-nci: don't print header length mismatch on i2c error
2022-06-29 14:05:00 +01:00
ntb
…
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-06-24 11:57:19 -07:00
nvme
nvme-pci: Crucial P2 has bogus namespace ids
2022-07-25 07:34:07 +02:00
nvmem
nvmem: sfp: Add support for TA 2.1 devices
2022-05-09 15:46:29 +02:00
of
drm for 5.19-rc1
2022-05-25 16:18:27 -07:00
opp
OPP updates for 5.19-rc1
2022-05-25 15:02:26 +02:00
parisc
…
parport
…
pci
Driver core changes for 5.19-rc1
2022-06-03 11:48:47 -07:00
pcmcia
ARM: multiplatform changes, part 2
2022-06-02 15:23:54 -07:00
peci
…
perf
arm64 updates for 5.19:
2022-05-23 21:06:11 -07:00
phy
phy-for-5.19
2022-05-19 16:56:17 +02:00
pinctrl
pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context
2022-07-19 00:57:38 +02:00
platform
platform-drivers-x86 for v5.19-4
2022-07-15 10:12:22 -07:00
pnp
…
power
power: supply: core: Fix boundary conditions in interpolation
2022-06-09 21:08:38 +02:00
powercap
Merge branches 'pm-em' and 'pm-cpuidle'
2022-05-23 19:18:51 +02:00
pps
…
ps3
…
ptp
ptp: ocp: Select CRC16 in the Kconfig.
2022-07-27 18:11:34 -07:00
pwm
pwm: pwm-cros-ec: Add channel type support
2022-05-20 16:40:01 +02:00
rapidio
…
ras
…
regulator
regulator: qcom_smd: correct MP5496 ranges
2022-06-07 20:38:09 +01:00
remoteproc
remoteproc: imx_rproc: Support i.MX93
2022-05-09 09:29:25 -06:00
reset
TI Driver updates for v5.19
2022-05-09 23:09:10 +02:00
rpmsg
Driver core changes for 5.19-rc1
2022-06-03 11:48:47 -07:00
rtc
ARM: multiplatform changes, part 2
2022-06-02 15:23:54 -07:00
s390
s390/qeth: Fix typo 'the the' in comment
2022-07-25 10:52:28 +01:00
sbus
…
scsi
scsi: core: Fix warning in scsi_alloc_sgtables()
2022-07-26 21:54:30 -04:00
sh
…
siox
…
slimbus
Driver core changes for 5.19-rc1
2022-06-03 11:48:47 -07:00
soc
soc: qcom: smem: use correct format characters
2022-07-04 14:26:51 +02:00
soundwire
soundwire: qcom: adjust autoenumeration timeout
2022-05-09 12:03:14 +05:30
spi
spi: spi-rspi: Fix PIO fallback on RZ platforms
2022-07-21 17:21:07 +01:00
spmi
…
ssb
ssb: remove unreachable code
2022-05-11 08:29:11 +03:00
staging
staging/wlan-ng: get the correct struct hfa384x in work callback
2022-07-01 09:58:58 +02:00
target
scsi: target: Fix WRITE_SAME No Data Buffer crash
2022-07-07 16:38:14 -04:00
tc
…
tee
tee: tee_get_drvdata(): fix description of return value
2022-07-08 10:51:24 +02:00
thermal
Thermal control update for 5.19-rc5
2022-07-01 13:00:47 -07:00
thunderbolt
USB / Thunderbolt changes for 5.19-rc1
2022-06-03 11:17:49 -07:00
tty
TTY / Serial driver fixes for 5.19-rc7
2022-07-16 11:11:56 -07:00
ufs
scsi: ufs: core: Fix a race condition related to device management
2022-07-26 21:59:29 -04:00
uio
uio: dfl: add HSSI subsystem feature id
2022-05-09 15:42:57 +02:00
usb
USB-serial fixes for 5.19-rc7
2022-07-14 16:22:12 +02:00
vdpa
vduse: Tie vduse mgmtdev and its device
2022-06-24 02:49:48 -04:00
vfio
vfio: Move IOMMU_CAP_CACHE_COHERENCY test to after we know we have a group
2022-07-05 16:06:50 -06:00
vhost
vhost-vdpa: call vhost_vdpa_cleanup during the release
2022-06-27 08:05:35 -04:00
video
fbcon: Use fbcon_info_from_console() in fbcon_modechange_possible()
2022-07-07 10:52:35 +02:00
virt
virt: sev-guest: Pass the appropriate argument type to iounmap()
2022-07-19 22:26:02 +02:00
virtio
virtio_ring: make vring_create_virtqueue_split prettier
2022-06-27 08:05:35 -04:00
vlynq
…
vme
…
w1
…
watchdog
watchdog: gxp: Add missing MODULE_LICENSE
2022-06-09 12:20:34 +02:00
xen
xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
2022-07-11 11:39:45 +02:00
zorro
…
Kconfig
SCSI misc on 20220604
2022-06-05 09:25:12 -07:00
Makefile
SCSI misc on 20220604
2022-06-05 09:25:12 -07:00