kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
No description
1,073,216 commits 117 branches 5,799 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Vikash Garodia 32af5c1fdb media: venus: hfi: add check to handle incorrect queue size 
commit 69baf245b2 upstream.

qsize represents size of shared queued between driver and video
firmware. Firmware can modify this value to an invalid large value. In
such situation, empty_space will be bigger than the space actually
available. Since new_wr_idx is not checked, so the following code will
result in an OOB write.
...
qsize = qhdr->q_size

if (wr_idx >= rd_idx)
 empty_space = qsize - (wr_idx - rd_idx)
....
if (new_wr_idx < qsize) {
 memcpy(wr_ptr, packet, dwords << 2) --> OOB write

Add check to ensure qsize is within the allocated size while
reading and writing packets into the queue.

Cc: stable@vger.kernel.org
Fixes: d96d3f30c0 ("[media] media: venus: hfi: add Venus HFI files")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-05-02 07:43:59 +02:00
arch arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD 2025-05-02 07:43:53 +02:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:31:51 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto crypto: testmgr - some more fixes to RSA test vectors 2025-03-13 12:50:48 +01:00
Documentation sched/isolation: Prevent boot crash when the boot CPU is nohz_full 2025-04-10 14:31:48 +02:00
drivers media: venus: hfi: add check to handle incorrect queue size 2025-05-02 07:43:59 +02:00
fs ext4: don't treat fhandle lookup of ea_inode as FS corruption 2025-05-02 07:43:59 +02:00
include drm/amdkfd: clamp queue size to minimum 2025-05-02 07:43:57 +02:00
init initramfs: avoid filename buffer overrun 2024-12-14 19:50:42 +01:00
io_uring io_uring: fix possible deadlock in io_register_iowq_max_workers() 2024-11-17 15:06:25 +01:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER 2025-05-02 07:43:56 +02:00
lib lib: 842: Improve error handling in sw842_compress() 2025-04-10 14:32:00 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm, slab: remove duplicate kernel-doc comment for ksize() 2025-04-10 14:32:06 +02:00
net bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags 2025-05-02 07:43:58 +02:00
samples samples/landlock: Fix possible NULL dereference in parse_path() 2025-03-13 12:49:57 +01:00
scripts selinux: Chain up tool resolving errors in install_policy.sh 2025-04-10 14:31:57 +02:00
security tomoyo: don't emit warning in tomoyo_write_control() 2025-03-13 12:50:18 +01:00
sound ALSA: usb-audio: Fix CME quirk for UF series keyboards 2025-05-02 07:43:54 +02:00
tools ktest: Fix Test Failures Due to Missing LOG_FILE Directories 2025-05-02 07:43:58 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-10-22 15:40:41 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS trace: Relocate event helper files 2024-04-10 16:19:24 +02:00
Makefile Linux 5.15.180 2025-04-10 14:32:07 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.