kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Ian Forbes 709e5c088f drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE 
[ Upstream commit 32b415a9dc ]

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Fixes: 8ce75f8ab9 ("drm/vmwgfx: Update device includes for DX device functionality")
Reported-by: Rohit Keshri <rkeshri@redhat.com>
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-12-07 06:09:29 +09:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi acpi,srat: Fix incorrect device handle check for Generic Initiator 2025-12-07 06:09:28 +09:00
amba amba: bus: fix refcount leak 2023-09-19 12:22:47 +02:00
android binder: remove "invalid inc weak" check 2025-10-29 14:03:12 +01:00
ata ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig 2025-08-28 16:24:32 +02:00
atm atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). 2025-09-04 14:28:45 +02:00
auxdisplay auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" 2025-06-04 14:37:57 +02:00
base regmap: slimbus: fix bus_context pointer in regmap init calls 2025-12-07 06:09:14 +09:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block drbd: add missing kref_get in handle_write_conflicts 2025-08-28 16:24:16 +02:00
bluetooth Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF 2025-12-07 06:09:27 +09:00
bus bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() 2025-10-19 16:21:44 +02:00
cdrom scsi: sr: cdrom: Move cdrom_read_cdda_bpc() into the sr driver 2021-07-30 22:13:09 -04:00
char char: misc: Does not request module for miscdevice with dynamic minor 2025-12-07 06:09:19 +09:00
clk clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled 2025-12-07 06:09:25 +09:00
clocksource clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel 2025-12-07 06:09:17 +09:00
comedi comedi: fix divide-by-zero in comedi_buf_munge() 2025-10-29 14:03:12 +01:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter counter: microchip-tcb-capture: Fix undefined counter channel state on probe 2025-04-10 14:31:56 +02:00
cpufreq cpufreq: tegra186: Initialize all cores to max frequencies 2025-12-07 06:09:25 +09:00
cpuidle cpuidle: Fail cpuidle device registration if there is one already 2025-12-07 06:09:17 +09:00
crypto crypto: rockchip - Fix dma_unmap_sg() nents value 2025-10-29 14:03:07 +01:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-23 13:47:17 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:24:17 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:14:27 +01:00
dma dmaengine: dw-edma: Set status for callback_result 2025-12-07 06:09:20 +09:00
dma-buf dma-buf: insert memory barrier before updating num_fences 2025-09-09 18:50:23 +02:00
edac minmax: make generic MIN() and MAX() macros available everywhere 2025-10-19 16:21:52 +02:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: adc-jack: Cleanup wakeup source only if it was enabled 2025-12-07 06:09:26 +09:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:51:01 +02:00
firmware arch: back to -std=gnu89 in < v5.18 2025-12-07 06:09:15 +09:00
fpga fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() 2025-08-28 16:24:34 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-19 12:22:46 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: wcd934x: mark the GPIO controller as sleeping 2025-10-19 16:21:43 +02:00
gpu drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE 2025-12-07 06:09:29 +09:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: quirks: avoid Cooler Master MM712 dongle wakeup bug 2025-12-07 06:09:27 +09:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-05-02 07:44:06 +02:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-10 15:57:36 +02:00
hwmon hwmon: (dell-smm) Add support for Dell OptiPlex 7040 2025-12-07 06:09:17 +09:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-12 11:07:41 +02:00
hwtracing coresight: trbe: Return NULL pointer for allocation failures 2025-10-19 16:21:36 +02:00
i2c i2c: designware: Add disabling clocks when probe fails 2025-10-19 16:21:32 +02:00
i3c i3c: master: svc: Recycle unused IBI slot 2025-10-19 16:21:31 +02:00
idle intel_idle: Allow loading ACPI tables for any family 2025-08-28 16:24:16 +02:00
iio iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register 2025-12-07 06:09:19 +09:00
infiniband RDMA/hns: Fix wrong WQE data when QP wraps around 2025-12-07 06:09:24 +09:00
input minmax: don't use max() in situations that want a C constant expression 2025-10-19 16:21:52 +02:00
interconnect interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node 2025-08-28 16:24:03 +02:00
iommu iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() 2025-12-07 06:09:23 +09:00
ipack ipack: ipoctal: fix module reference leak 2021-09-27 17:38:49 +02:00
irqchip irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment 2025-12-07 06:09:16 +09:00
isdn mISDN: Fix memory leak in dsp_hwec_enable() 2025-09-09 18:50:18 +02:00
leds leds: leds-lp50xx: Handle reg to get correct multi_index 2025-08-28 16:24:23 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-19 05:45:06 +02:00
mailbox mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes 2025-10-19 16:21:42 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:44:31 +02:00
md minmax: don't use max() in situations that want a C constant expression 2025-10-19 16:21:52 +02:00
media media: redrat3: use int type to store negative error codes 2025-12-07 06:09:21 +09:00
memory memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe 2025-10-19 16:21:47 +02:00
memstick memstick: Add timeout to prevent indefinite waiting 2025-12-07 06:09:16 +09:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:51:02 +01:00
mfd mfd: da9063: Split chip variant reading in two bus transactions 2025-12-07 06:09:18 +09:00
misc mei: me: add wildcat lake P DID 2025-10-29 14:03:12 +01:00
mmc mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card 2025-12-07 06:09:17 +09:00
most most: usb: hdm_probe: Fix calling put_device() before device initialization 2025-10-29 14:03:13 +01:00
mtd mtd: rawnand: fsmc: Default to autodetect buswidth 2025-10-19 16:21:47 +02:00
mux mux: gpio: Simplify code by using dev_err_probe() 2021-04-02 16:28:53 +02:00
net net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps 2025-12-07 06:09:28 +09:00
nfc minmax: make generic MIN() and MAX() macros available everywhere 2025-10-19 16:21:52 +02:00
ntb ntb: reduce stack usage in idt_scan_mws 2025-05-02 07:44:36 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:25:05 +01:00
nvdimm libnvdimm/labels: Fix divide error in nd_label_data_init() 2025-06-04 14:37:55 +02:00
nvme nvme-fc: use lock accessing port_state and rport state 2025-12-07 06:09:17 +09:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-03-13 12:50:32 +01:00
of of: module: add buffer overflow check in of_modalias() 2025-05-09 09:39:41 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc parisc: iosapic.c: Fix sparse warnings 2023-10-06 13:18:15 +02:00
parport parport_pc: add support for ASIX AX99100 2025-03-13 12:50:46 +01:00
pci PCI: cadence: Check for the existence of cdns_pcie::ops before using it 2025-12-07 06:09:23 +09:00
pcmcia pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch 2025-10-02 13:39:05 +02:00
perf perf: arm_spe: Prevent overflow in PERF_IDX2OFF() 2025-10-19 16:21:29 +02:00
phy phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 2025-12-07 06:09:21 +09:00
pinctrl pinctrl: single: fix bias pull up/down handling in pin_config_set 2025-12-07 06:09:16 +09:00
platform minmax: make generic MIN() and MAX() macros available everywhere 2025-10-19 16:21:52 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: sbs-charger: Support multiple devices 2025-12-07 06:09:17 +09:00
powercap powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed 2025-08-28 16:24:03 +02:00
pps pps: fix warning in pps_register_cdev when register device fail 2025-10-19 16:21:33 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Limit time setting of PTP clocks 2025-12-07 06:09:20 +09:00
pwm pwm: berlin: Fix wrong register in suspend/resume 2025-10-19 16:21:46 +02:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-27 11:05:33 +01:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: fixed: fix GPIO descriptor leak on register failure 2025-12-07 06:09:28 +09:00
remoteproc remoteproc: qcom: q6v5: Avoid handling handover twice 2025-12-07 06:09:23 +09:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-28 16:24:18 +02:00
rpmsg rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() 2025-06-27 11:05:15 +01:00
rtc rtc: rx8025: fix incorrect register reference 2025-12-07 06:09:26 +09:00
s390 s390/cio: Update purge function to unregister the unused subchannels 2025-10-29 14:03:13 +01:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() 2025-12-07 06:09:23 +09:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-09 13:28:34 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-26 09:24:36 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:51:10 +01:00
soc soc: ti: pruss: don't use %pK through printk 2025-12-07 06:09:16 +09:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-28 16:24:10 +02:00
spi spi: loopback-test: Don't use %pK through printk 2025-12-07 06:09:16 +09:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging minmax: make generic MIN() and MAX() macros available everywhere 2025-10-19 16:21:52 +02:00
target scsi: target: target_core_configfs: Add length check to avoid buffer overflow 2025-10-19 16:21:26 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: allow a driver to allocate a tee_device without a pool 2025-12-07 06:09:17 +09:00
thermal thermal/drivers/qcom/lmh: Add missing IRQ includes 2025-10-19 16:21:31 +02:00
thunderbolt thunderbolt: Use is_pciehp instead of is_hotplug_bridge 2025-12-07 06:09:19 +09:00
tty serial: 8250_dw: handle reset control deassert error 2025-12-07 06:09:14 +09:00
uio uio_hv_generic: Let userspace take care of interrupt mask 2025-10-19 16:21:38 +02:00
usb usb: xhci: plat: Facilitate using autosuspend for xhci plat devices 2025-12-07 06:09:22 +09:00
vdpa vdpa/mlx5: Fix oversized null mkey longer than 32bit 2025-05-02 07:44:02 +02:00
vfio vfio/type1: Fix error unwind in migration dirty bitmap allocation 2025-06-27 11:05:13 +01:00
vhost vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() 2025-09-04 14:28:44 +02:00
video fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds 2025-12-07 06:09:25 +09:00
virt minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
virtio virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN 2025-06-04 14:37:54 +02:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-06-04 15:27:26 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme vme: Fix error not catched in fake_init() 2022-12-31 13:14:30 +01:00
w1 w1: fix loop in w1_fini() 2023-07-23 13:47:20 +02:00
watchdog watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog 2025-10-19 16:21:34 +02:00
xen xen/events: Update virq_to_irq on migration 2025-10-19 16:21:55 +02:00
zorro zorro: Drop useless (and hardly used) .driver member in struct zorro_dev 2021-08-05 14:37:04 +02:00
Kconfig firmware: include drivers/firmware/Kconfig unconditionally 2021-10-07 16:51:26 +02:00
Makefile virtio: always enter drivers/virtio/ 2021-12-22 09:32:39 +01:00