kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/misc
History
Hagar Gamal Halim Hemdan 95ac3e773a vmci: prevent speculation leaks by sanitizing event in event_deliver() 
commit 8003f00d89 upstream.

Coverity spotted that event_msg is controlled by user-space,
event_msg->event_data.event is passed to event_deliver() and used
as an index without sanitization.

This change ensures that the event index is sanitized to mitigate any
possibility of speculative information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Only compile tested, no access to HW.

Fixes: 1d990201f9 ("VMCI: event handling implementation.")
Cc: stable <stable@kernel.org>
Signed-off-by: Hagar Gamal Halim Hemdan <hagarhem@amazon.com>
Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com
Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-07-05 09:14:20 +02:00
..
altera-stapl altera-stapl: remove the unreached switch case 2020-12-09 19:53:03 +01:00
bcm-vk misc: bcm-vk: fix tty registration race 2021-09-21 16:17:15 +02:00
c2port misc: c2port: core: Make copying name from userspace more secure 2020-11-03 10:12:10 +01:00
cardreader misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to probe 2023-10-06 13:18:21 +02:00
cb710 cb710: avoid NULL pointer subtraction 2021-10-05 15:50:05 +02:00
cxl cxl: Fix refcount leak in cxl_calc_capp_routing 2022-12-31 13:14:35 +01:00
echo char: Replace HTTP links with HTTPS ones 2020-07-23 09:44:15 +02:00
eeprom eeprom: at24: fix memory corruption race condition 2024-05-17 11:50:44 +02:00
genwqe misc: genwqe: Fixes DMA mask setting 2021-09-14 10:45:41 +02:00
habanalabs habanalabs/gaudi: mask constant value before cast 2022-08-25 11:40:36 +02:00
ibmasm Char / Misc driver updates for 5.14-rc1 2021-07-05 13:42:16 -07:00
lis3lv02d platform/x86: hp_accel: Remove _INI method call 2021-08-26 15:09:18 +02:00
lkdtm drivers: lkdtm: fix clang -Wformat warning 2024-02-23 08:54:59 +01:00
mei mei: me: release irq in mei_me_pci_resume error path 2024-07-05 09:14:14 +02:00
ocxl ocxl: fix pci device refcount leak when calling get_function_0() 2022-12-31 13:14:29 +01:00
pvpanic misc/pvpanic-pci: register attributes via pci_driver 2024-07-05 09:14:10 +02:00
sgi-gru misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os 2022-12-31 13:14:29 +01:00
sgi-xp sgi-xpc: Replace deprecated CPU-hotplug functions. 2021-08-03 16:30:36 +02:00
ti-st misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() 2023-11-20 11:08:25 +01:00
uacce uacce: Handle parent device removal or parent driver module rmmod 2022-08-25 11:40:34 +02:00
vmw_vmci vmci: prevent speculation leaks by sanitizing event in event_deliver() 2024-07-05 09:14:20 +02:00
ad525x_dpot-i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad525x_dpot-spi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad525x_dpot.c drivers: misc: ad525x_dpot: Add missing check in dpot_read_spi 2021-03-10 09:21:02 +01:00
ad525x_dpot.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
apds990x.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336 2019-06-05 17:37:07 +02:00
apds9802als.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 167 2019-05-30 11:26:39 -07:00
atmel-ssc.c misc: atmel-ssc: Fix IRQ check in ssc_probe 2022-06-22 14:22:00 +02:00
bh1770glc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336 2019-06-05 17:37:07 +02:00
cs5535-mfgpt.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206 2019-05-30 11:29:53 -07:00
ds1682.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
dummy-irq.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
dw-xdata-pcie.c misc: Add Synopsys DesignWare xData IP driver 2021-04-05 13:15:52 +02:00
enclosure.c misc: enclosure: Update enclosure_remove_device() documentation to match reality 2020-07-01 15:05:37 +02:00
fastrpc.c misc: fastrpc: Mark all sessions as invalid in cb_remove 2024-02-23 08:55:06 +01:00
gehc-achc.c misc: gehc: Add SPI ID table 2021-10-05 15:47:18 +02:00
hi6421v600-irq.c staging: hikey9xx: split hi6421v600 irq into a separate driver 2021-07-21 11:24:43 +02:00
hisi_hikey_usb.c misc: hisi_hikey_usb: use PTR_ERR_OR_ZERO 2020-10-29 08:37:29 +01:00
hmc6352.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 167 2019-05-30 11:26:39 -07:00
hpilo.c misc: hpilo: map iLO shared memory by PCI revision id 2021-06-04 15:28:23 +02:00
hpilo.h misc: hpilo: map iLO shared memory by PCI revision id 2021-06-04 15:28:23 +02:00
ibmvmc.c vio: make remove callback return void 2021-03-02 22:41:23 +11:00
ibmvmc.h misc: Use the correct style for SPDX License Identifier 2019-10-10 15:34:40 +02:00
ics932s401.c ics932s401: fix broken handling of errors when word reading fails 2021-05-13 17:21:54 +02:00
isl29003.c misc: isl29003: Fix typo for get/set mode 2020-12-09 19:35:34 +01:00
isl29020.c misc: isl29020: add missed pm_runtime_disable 2020-01-14 15:06:07 +01:00
Kconfig misc: HI6421V600_IRQ should depend on HAS_IOMEM 2021-10-05 16:07:56 +02:00
kgdbts.c kgdbts: fix return value of __setup handler 2022-04-08 14:23:50 +02:00
lattice-ecp3-config.c misc: lattice-ecp3-config: Fix task hung when firmware load failed 2022-01-27 11:04:17 +01:00
Makefile IIO / Staging driver update for 5.15-rc1 2021-09-01 09:45:57 -07:00
pch_phub.c misc: pch_phub: Remove superfluous descriptions to non-existent args 'offset_address' 2020-07-01 15:05:37 +02:00
pci_endpoint_test.c misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller 2023-11-28 16:56:19 +00:00
phantom.c misc/phantom.c: use generic power management 2020-06-29 18:43:42 +02:00
qcom-coincell.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
sram-exec.c char: Replace HTTP links with HTTPS ones 2020-07-23 09:44:15 +02:00
sram.c misc: sram: Only map reserved areas in Tegra SYSRAM 2021-08-05 14:27:46 +02:00
sram.h misc: sram: Only map reserved areas in Tegra SYSRAM 2021-08-05 14:27:46 +02:00
tifm_7xx1.c misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() 2022-12-31 13:14:29 +01:00
tifm_core.c bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
tsl2550.c misc: tsl2550: remove redundant initialization to variable r 2020-01-14 15:16:51 +01:00
vmw_balloon.c misc: vmw_balloon: fix memory leak with using debugfs_lookup() 2023-03-11 13:57:38 +01:00
xilinx_sdfec.c misc: xilinx-sdfec: Drop unnecessary NULL check after container_of 2021-05-21 22:14:48 +02:00