kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/rapidio
History
Andrew Morton 58f664614f drivers/rapidio/rio_cm.c: prevent possible heap overwrite 
commit 50695153d7 upstream.

In

riocm_cdev_ioctl(RIO_CM_CHAN_SEND)
   -> cm_chan_msg_send()
      -> riocm_ch_send()

cm_chan_msg_send() checks that userspace didn't send too much data but
riocm_ch_send() failed to check that userspace sent sufficient data.  The
result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr
which were outside the bounds of the space which cm_chan_msg_send()
allocated.

Address this by teaching riocm_ch_send() to check that the entire
rio_ch_chan_hdr was copied in from userspace.

Reported-by: maher azz <maherazz04@gmail.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-06-27 11:05:33 +01:00
..
devices rapidio: fix an API misues when rio_add_net() fails 2025-03-13 12:51:03 +01:00
switches treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Kconfig rapidio: Replace 'select' DMAENGINES 'with depends on' 2020-09-05 19:52:54 +03:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rio-access.c drivers/rapidio/rio-access.c: fix missing include of <linux/rio_drv.h> 2019-12-04 19:44:13 -08:00
rio-driver.c bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
rio-scan.c rapidio: add check for rio_add_net() in rio_scan_alloc_net() 2025-03-13 12:51:03 +01:00
rio-sysfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rio.c rapidio: rio: fix possible name leak in rio_register_mport() 2022-12-31 13:14:03 +01:00
rio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rio_cm.c drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-27 11:05:33 +01:00