kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Arend Van Spriel 7df83adfc5 brcmfmac: add length check in brcmf_cfg80211_escan_handler() 
commit 17df6453d4 upstream.

Upon handling the firmware notification for scans the length was
checked properly and may result in corrupting kernel heap memory
due to buffer overruns. This fix addresses CVE-2017-0786.

Cc: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.16:
 - Use WL_ESCAN_BUF_SIZE instead of BRCMF_ESCAN_BUF_SIZE
 - Adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-11-11 13:33:37 +00:00
..
accessibility printk: move braille console support into separate braille.[ch] files 2013-07-31 14:41:03 -07:00
acpi Revert "ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC" 2017-10-12 15:28:15 +01:00
amba ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
ata libata: array underflow in ata_find_dev() 2017-11-11 13:33:00 +00:00
atm atm: iphase: fix misleading indention 2017-04-04 22:21:54 +01:00
auxdisplay auxdisplay: ks0108: fix refcount 2015-09-28 10:21:35 +01:00
base PM / QoS: return -EINVAL for bogus strings 2017-10-12 15:28:05 +01:00
bcma bcma: use (get|put)_device when probing/removing device driver 2017-06-05 21:17:01 +01:00
block xen-blkback: don't leak stack data via response ring 2017-07-18 18:40:40 +01:00
bluetooth Bluetooth: Add another AR3012 04ca:3018 device 2017-06-05 21:17:09 +01:00
bus bus: vexpress-config: fix device reference leak 2017-03-16 02:26:27 +00:00
cdrom Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2014-06-11 08:41:17 -07:00
char tpm: fix a kernel memory leak in tpm-sysfs.c 2017-10-12 15:28:02 +01:00
clk clk: renesas: mstp: ensure register writes complete 2017-06-05 21:17:10 +01:00
clocksource clocksource/exynos_mct: Clear interrupt when cpu is shut down 2017-03-16 02:27:00 +00:00
connector connector: bump skb->users before callback invocation 2016-01-28 10:14:29 +00:00
cpufreq cpufreq: conservative: Allow down_threshold to take values from 1 to 10 2017-09-15 18:30:09 +01:00
cpuidle cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() 2016-08-22 22:38:01 +01:00
crypto crypto: atmel - only treat EBUSY as transient if backlog 2017-10-12 15:28:05 +01:00
dca dca: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
devfreq PM / devfreq: Fix the bug of devfreq_add_device when governor is NULL 2017-03-16 02:26:43 +00:00
dio m68k: don't export static inline functions 2009-12-06 11:18:28 +01:00
dma dmaengine: ep93xx: Always start from BASE0 2017-09-15 18:29:50 +01:00
edac EDAC: Increment correct counter in edac_inc_ue_error() 2016-08-22 22:37:51 +01:00
eisa Revert "EISA: Initialize device before its resources" 2014-01-17 14:57:29 -07:00
extcon extcon: palmas: Use devm_extcon_dev_allocate for extcon_dev 2014-04-29 09:52:12 +09:00
firewire firewire: net: fix fragmented datagram_size off-by-one 2017-02-23 03:54:28 +00:00
firmware efi/libstub: Allocate headspace in efi_get_memory_map() 2016-11-20 01:17:23 +00:00
fmc Merge 3.14-rc5 into char-misc-next 2014-03-02 19:53:09 -08:00
gpio gpio: tegra: fix unbalanced chained_irq_enter/exit 2017-11-11 13:33:14 +00:00
gpu drm: Release driver tracking before making the object available again 2017-11-11 13:33:23 +00:00
hid HID: Add quirk for Dell PIXART OEM mouse 2017-09-15 18:30:04 +01:00
hsi HSI: ssi_protocol: double free in ssip_pn_xmit() 2017-08-26 02:14:37 +01:00
hv drivers: hv: Turn off write permission on the hypercall page 2017-06-05 21:17:07 +01:00
hwmon hwmon: (asus_atk0110) fix uninitialized data access 2017-07-18 18:40:22 +01:00
hwspinlock A single patch from Vincent extending OMAP's hwspinlock support to OMAP5. 2013-05-07 14:01:27 -07:00
i2c i2c: ismt: Return EMSGSIZE for block reads with bogus length 2017-11-11 13:33:33 +00:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2014-07-21 22:44:24 -07:00
idle intel_idle: fix IVT idle state table setting 2014-04-21 23:36:07 +02:00
iio iio: imu: adis16480: Fix acceleration scale factor for adis16480 2017-11-11 13:33:23 +00:00
infiniband IB/uverbs: Fix device cleanup 2017-11-11 13:33:15 +00:00
input Input: trackpoint - add new trackpoint firmware ID 2017-11-11 13:33:23 +00:00
iommu iommu/amd: Fix schedule-while-atomic BUG in initialization code 2017-11-11 13:33:09 +00:00
ipack ipack: convert bus code to use dev_groups 2013-10-16 18:40:57 -07:00
irqchip irqchip: brcmstb-l2: Define an irq_pm_shutdown function 2017-11-11 13:33:16 +00:00
isdn isdn/gigaset: fix NULL-deref at probe 2017-07-18 18:40:12 +01:00
leds leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger 2015-07-09 14:36:01 +01:00
lguest lguest: fix out-by-one error in address checking. 2015-06-03 14:30:03 +01:00
macintosh macintosh/therm_windtunnel: Export I2C module alias information 2017-10-12 15:28:18 +01:00
mailbox drivers/mailbox/omap: make mbox->irq signed for error handling 2014-01-23 16:36:53 -08:00
mcb mcb: Fixed bar number assignment for the gdd 2016-08-22 22:37:53 +01:00
md dm: fix printk() rate limiting code 2017-11-11 13:33:30 +00:00
media media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl 2017-11-11 13:33:08 +00:00
memory memory: mvebu-devbus: add a devbus, keep-config property 2014-04-29 13:17:10 +00:00
memstick memstick: rtsx_usb_ms: Manage runtime PM when accessing the device 2017-02-23 03:54:16 +00:00
message mptfusion: enable no_write_same for vmware scsi disks 2014-10-30 09:40:12 -07:00
mfd mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode 2017-08-26 02:14:40 +01:00
misc misc: ad525x_dpot: Fix the enabling of the "otpXen" attributes 2017-10-12 15:28:17 +01:00
mmc mmc: sdhci: Disable runtime pm when the sdio_irq is enabled 2017-07-18 18:40:27 +01:00
mtd mtd: nandsim: remove debugfs entries in error path 2017-11-11 13:33:27 +00:00
net brcmfmac: add length check in brcmf_cfg80211_escan_handler() 2017-11-11 13:33:37 +00:00
nfc NFC: microread: Potential overflows in microread_target_discovered() 2014-10-05 13:41:05 -07:00
ntb ntb: Use pci_enable_msix_range() instead of pci_enable_msix() 2014-04-07 10:59:20 -07:00
nubus kernel/printk: use symbolic defines for console loglevels 2014-06-04 16:54:17 -07:00
of of: device: Export of_device_{get_modalias, uvent_modalias} to modules 2017-11-11 13:32:58 +00:00
oprofile oprofile, nmi-timer: Fix CPU hotplug callback registration 2014-03-20 13:43:46 +01:00
parisc parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo 2017-11-11 13:33:21 +00:00
parport parport: fix menu breakage 2014-07-25 18:00:23 -07:00
pci PCI: Limit config space size for Netronome NFP4000 2017-10-12 15:28:20 +01:00
pcmcia Disable write buffering on Toshiba ToPIC95 2015-07-15 10:00:33 +01:00
phy phy: sun4i-usb: Use spinlock to guard phyctl register access 2017-02-23 03:53:59 +00:00
pinctrl pinctrl: sunxi: add a missing function of A10/A20 pinctrl driver 2017-11-11 13:33:11 +00:00
platform platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event 2017-06-05 21:17:22 +01:00
pnp ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage 2015-07-15 10:01:34 +01:00
power power: supply: pda_power: move from timer to delayed_work 2017-08-26 02:14:42 +01:00
powercap PowerCap: Fix an error code in powercap_register_zone() 2017-09-15 18:29:35 +01:00
pps pps: do not crash when failed to register 2016-11-20 01:16:57 +00:00
ps3 ps3-vuart: don't use PREPARE_WORK 2014-03-07 10:24:48 -05:00
ptp ptp: ptp_pch depends on x86_32 2014-06-17 15:43:48 -07:00
pwm pwm: Fix device reference leak 2017-02-23 03:54:40 +00:00
rapidio rapidio/tsi721_dma: fix failure to obtain transaction descriptor 2014-07-30 17:16:13 -07:00
regulator regulator: tps65023: Fix inverted core enable logic. 2017-08-26 02:14:34 +01:00
remoteproc remoteproc: avoid stack overflow in debugfs file 2016-01-05 12:08:23 +00:00
reset reset: sunxi: fix spinlock initialization 2015-01-22 16:33:34 +00:00
rpmsg A small pull request consisting of: 2013-05-07 14:02:00 -07:00
rtc rtc: rtc-nuc900: fix loop timeout test 2017-10-12 15:28:02 +01:00
s390 s390/qeth: fix L3 next-hop in xmit qeth hdr 2017-11-11 13:33:17 +00:00
sbus bbc-i2c: Fix BBC I2C envctrl on SunBlade 2000 2014-08-14 10:09:44 +08:00
scsi scsi: st: fix blk_get_queue usage 2017-11-11 13:33:17 +00:00
sfi SFI / ACPI: Fix warnings reported during builds with W=1 2013-12-07 01:24:33 +01:00
sh SH Driver Update for v3.16 2014-06-06 11:44:09 -07:00
sn Drivers: misc: remove __dev* attributes. 2013-01-03 15:57:16 -08:00
soc soc: qcom: fix of_device_id table 2014-05-26 21:27:09 +02:00
spi spi: atmel: fix corrupted data issue on SAM9 family SoCs 2017-10-12 15:27:51 +01:00
spmi spmi: Include OF based modalias in device uevent 2017-11-11 13:32:58 +00:00
ssb ssb: Fix error routine when fallback SPROM fails 2017-03-16 02:26:23 +00:00
staging staging: rtl8188eu: add RNX-N150NUB support 2017-11-11 13:33:22 +00:00
target iscsi-target: Fix iscsi_np reset hung task during parallel delete 2017-11-11 13:33:16 +00:00
tc TC: Handle device_register() errors. 2014-06-26 10:48:23 +01:00
thermal thermal: hwmon: Properly report critical temperature in sysfs 2017-03-16 02:26:26 +00:00
tty serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios() 2017-10-12 15:28:17 +01:00
uio uio: fix incorrect memory leak cleanup 2017-09-15 18:29:40 +01:00
usb usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter 2017-11-11 13:33:19 +00:00
uwb uwb: fix device quirk on big-endian hosts 2017-09-15 18:29:40 +01:00
vfio vfio: New external user group/file match 2017-10-12 15:27:55 +01:00
vhost vhost: actually track log eventfd file 2015-08-25 10:13:39 +01:00
video video: fbdev: aty: do not leak uninitialized padding in clk to userspace 2017-10-12 15:28:11 +01:00
virt drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
virtio virtio_balloon: prevent uninitialized variable use 2017-07-18 18:40:24 +01:00
vlynq drivers/vlynq/vlynq.c: fix another resource size off by 1 error 2014-01-23 16:36:55 -08:00
vme vme: Fix wrong pointer utilization in ca91cx42_slave_get 2017-03-16 02:26:56 +00:00
w1 w1: don't leak refcount on slave attach failure in w1_attach_slave_device() 2017-06-05 21:16:58 +01:00
watchdog watchdog: bcm281xx: Fix use of uninitialized spinlock. 2017-09-15 18:29:46 +01:00
xen xen: fix bio vec merging 2017-09-15 18:30:18 +01:00
zorro zorro/UAPI: Use proper types (endianness/size) in <linux/zorro.h> 2013-11-26 11:09:09 +01:00
Kconfig soc: Introduce drivers/soc place-holder for SOC specific drivers 2014-05-23 11:37:46 -05:00
Makefile usb: Make sure usb/phy/of gets built-in 2017-08-26 02:14:39 +01:00