kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Bui Quang Minh 06cb37e2ba bna: ensure the copied buf is NUL terminated 
[ Upstream commit 8c34096c7f ]

Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
userspace to that buffer. Later, we use sscanf on this buffer but we don't
ensure that the string is terminated inside the buffer, this can lead to
OOB read when using sscanf. Fix this issue by using memdup_user_nul
instead of memdup_user.

Fixes: 7afc5dbde0 ("bna: Add debugfs interface.")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-2-f1f1b53a10f4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-05-17 11:55:58 +02:00
..
accessibility speakup: Avoid crash on very long word 2024-04-27 17:07:15 +02:00
acpi ACPI: CPPC: Fix access width used for PCC registers 2024-05-02 16:29:29 +02:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: check offset alignment in binder_get_object() 2024-04-27 17:07:13 +02:00
ata ata: libata-scsi: Fix ata_scsi_dev_rescan() error path 2024-04-17 11:18:22 +02:00
atm atm: idt77252: fix a memleak in open_card_ubr0 2024-02-16 19:06:26 +01:00
auxdisplay auxdisplay: hd44780: move cursor home after clear display command 2023-12-08 08:51:16 +01:00
base driver core: Introduce device_link_wait_removal() 2024-04-10 16:28:32 +02:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts 2024-03-26 18:20:29 -04:00
bluetooth Bluetooth: qca: add support for QCA2066 2024-05-17 11:55:51 +02:00
bus bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state 2024-04-13 13:05:16 +02:00
cdrom block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
char random: handle creditable entropy from atomic process context 2024-04-27 17:07:04 +02:00
clk clk: mediatek: Do a runtime PM get on controllers during probe 2024-04-27 17:07:13 +02:00
clocksource clocksource/drivers/arm_global_timer: Fix maximum prescaler value 2024-04-03 15:19:44 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:07:14 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: microchip-tcb-capture: Fix the use of internal GCLK logic 2023-10-19 23:08:58 +02:00
cpufreq cpufreq: Don't unregister cpufreq cooling on CPU hotplug 2024-04-13 13:05:00 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:04:54 +02:00
crypto crypto: qat - resolve race condition during AER recovery 2024-04-03 15:19:26 +02:00
cxl cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window 2024-03-01 13:26:31 +01:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-19 16:21:43 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:12:47 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" 2024-05-17 11:55:50 +02:00
dma-buf dma-buf: Fix NULL pointer dereference in sanitycheck() 2024-04-10 16:28:21 +02:00
edac EDAC/thunderx: Fix possible out-of-bounds string access 2024-01-25 15:27:18 -08:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: cht_wc: add POWER_SUPPLY dependency 2023-09-13 09:42:53 +02:00
firewire firewire: core: use long bus reset on gap count error 2024-03-26 18:20:27 -04:00
firmware x86/efistub: Remap kernel text read-only before dropping NX attribute 2024-04-27 17:07:07 +02:00
fpga fpga: bridge: fix kernel-doc parameter description 2023-05-11 23:03:27 +09:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: vf610: allow disabling the vf610 driver 2024-03-26 18:20:33 -04:00
gpu drm/amdgpu: Fix leak when GPU memory allocation fails 2024-05-02 16:29:29 +02:00
greybus greybus: svc: clean up link configuration hack at hello 2022-02-04 15:27:44 +01:00
hid HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up 2024-05-02 16:29:28 +02:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2022-12-31 13:32:45 +01:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: vmbus: Don't dereference ACPI root object handle 2023-09-13 09:42:59 +02:00
hwmon hwmon: (amc6821) add of_match table 2024-04-03 15:19:32 +02:00
hwspinlock hwspinlock: qcom: add missing regmap config for SFPB MMIO implementation 2023-09-19 12:28:05 +02:00
hwtracing hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() 2024-03-26 18:20:58 -04:00
i2c i2c: smbus: fix NULL function pointer dereference 2024-05-02 16:29:32 +02:00
i3c i3c: master: cdns: Update maximum prescaler value for i2c clock 2024-02-05 20:12:58 +00:00
idle intel_idle: add Emerald Rapids Xeon support 2023-10-10 22:00:44 +02:00
iio iio: accel: adxl367: fix I2C FIFO data register 2024-04-03 15:19:43 +02:00
infiniband RDMA/mlx5: Fix port number for counter query in multi-port configuration 2024-04-27 17:07:09 +02:00
input Input: imagis - use FIELD_GET where applicable 2024-04-13 13:05:13 +02:00
interconnect Revert "interconnect: Teach lockdep about icc_bw_lock order" 2024-03-06 14:45:19 +00:00
iommu iommu/vt-d: Allocate local memory for page request queue 2024-04-17 11:18:26 +02:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip/gic-v3-its: Prevent double free on error 2024-05-02 16:29:29 +02:00
isdn mISDN: Update parameter type of dsp_cmx_send() 2023-08-16 18:27:26 +02:00
leds leds: sgm3140: Add missing timer cleanup and flash gpio control 2024-03-26 18:20:52 -04:00
macintosh macintosh: via-pmu-led: requires ATA to be set 2023-05-11 23:03:31 +09:00
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-05 20:12:58 +00:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:07:13 +00:00
md dm integrity: fix out-of-range warning 2024-04-10 16:28:23 +02:00
media media: cec: core: remove length check of Timer Status 2024-04-17 11:18:23 +02:00
memory memory: brcmstb_dpfe: fix testing array offset after use 2023-07-19 16:21:24 +02:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-07-19 16:21:08 +02:00
message scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition 2023-05-24 17:32:37 +01:00
mfd mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref 2024-03-26 18:20:50 -04:00
misc eeprom: at24: fix memory corruption race condition 2024-05-17 11:55:51 +02:00
mmc mmc: sdhci-msm: pervent access to suspended controller 2024-05-02 16:29:28 +02:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd mtd: diskonchip: work around ubsan link failure 2024-05-02 16:29:30 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net bna: ensure the copied buf is NUL terminated 2024-05-17 11:55:58 +02:00
nfc NFC: trf7970a: disable all regulators on removal 2024-05-02 16:29:24 +02:00
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:20:49 -04:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm nd_btt: Make BTT lanes preemptible 2023-11-20 11:52:05 +01:00
nvme nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH 2024-05-17 11:55:56 +02:00
nvmem nvmem: meson-efuse: fix function pointer type mismatch 2024-04-03 15:19:32 +02:00
of of: dynamic: Synchronize of_changeset_destroy() with the devlink removals 2024-04-10 16:28:32 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:20:42 -04:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport parport: parport_serial: Add Brainboxes device IDs and geometry 2024-01-20 11:50:11 +01:00
pci PCI/ASPM: Fix deadlock when enabling ASPM 2024-04-27 17:07:18 +02:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2023-11-20 11:52:13 +01:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported 2024-04-10 16:28:30 +02:00
phy phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered 2024-05-02 16:29:31 +02:00
pinctrl pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() 2024-05-17 11:55:55 +02:00
platform platform/x86: intel-vbtn: Update tablet mode switch at end of probe 2024-04-13 13:05:26 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator 2024-05-17 11:55:55 +02:00
powercap powercap: dtpm_cpu: Fix error check against freq_qos_add_request() 2024-03-26 18:20:36 -04:00
pps pps: generators: pps_gen_parport: Switch to use module_parport_driver() 2022-03-18 14:01:19 +01:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: annotate data-race around q->head and q->tail 2023-11-28 17:07:05 +00:00
pwm pwm: img: fix pwm clock lookup 2024-04-03 15:19:45 +02:00
rapidio rapidio: devices: fix missing put_device in mport_cdev_open 2022-12-31 13:32:00 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: mt6360: De-capitalize devicetree regulator subnodes 2024-05-17 11:55:55 +02:00
remoteproc remoteproc: virtio: Fix wdg cannot recovery remote processor 2024-04-03 15:19:24 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-20 11:50:07 +01:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-01-31 16:16:59 -08:00
rtc rtc: mt6397: select IRQ_DOMAIN instead of depending on it 2024-03-26 18:20:58 -04:00
s390 s390/cio: fix race condition during online processing 2024-04-27 17:07:09 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() 2024-04-17 11:18:23 +02:00
sh genirq: Add and use an irq_data_update_affinity helper 2022-07-07 09:38:04 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: core: Remove usage of the deprecated ida_simple_xx() API 2024-04-03 15:19:33 +02:00
soc soc: fsl: qbman: Use raw spinlock for cgr_lock 2024-04-03 15:19:36 +02:00
soundwire ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops 2024-04-13 13:05:07 +02:00
spi spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs 2024-05-17 11:55:58 +02:00
spmi spmi: mediatek: Fix UAF on device remove 2024-02-05 20:12:58 +00:00
ssb ssb: gpio: Use generic_handle_irq_safe() 2022-09-19 15:08:38 +02:00
staging staging: vc04_services: fix information leak in create_component() 2024-04-03 15:19:51 +02:00
target scsi: target: pscsi: Fix bio_put() for error case 2024-03-01 13:26:31 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-03 15:19:42 +02:00
thermal thermal/of: Assume polling-delay(-passive) 0 when absent 2024-04-13 13:05:19 +02:00
thunderbolt thunderbolt: Fix wake configurations after device unplug 2024-04-27 17:07:14 +02:00
tty serial: stm32: Reset .throttled state in .startup() 2024-04-27 17:07:14 +02:00
ufs scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare() 2024-03-01 13:26:30 +01:00
uio uio: Fix use-after-free in uio_open 2024-01-20 11:50:10 +01:00
usb usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error 2024-04-27 17:07:15 +02:00
vdpa vdpa/mlx5: Allow CVQ size changes 2024-03-26 18:21:00 -04:00
vfio vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-03 15:19:47 +02:00
vhost vhost: Add smp_rmb() in vhost_enable_notify() 2024-04-17 11:18:27 +02:00
video fbdev: fix incorrect address computation in deferred IO 2024-05-02 16:29:30 +02:00
virt virt: sevguest: Fix passing a stack buffer as a scatterlist target 2023-11-20 11:52:13 +01:00
virtio virtio: reenable config if freezing device failed 2024-04-13 13:05:25 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: stm32_iwdg: initialize default timeout 2024-03-26 18:20:56 -04:00
xen xen/events: close evtchn after mapping cleanup 2024-03-06 14:45:20 +00:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00