kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
No description
1,400,708 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Miaoqian Lin db16e7c520 iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source 
commit 978d28136c upstream.

When simple_write_to_buffer() succeeds, it returns the number of bytes
actually copied to the buffer. The code incorrectly uses 'count'
as the index for null termination instead of the actual bytes copied.
If count exceeds the buffer size, this leads to out-of-bounds write.
Add a check for the count and use the return value as the index.

The bug was validated using a demo module that mirrors the original
code and was tested under QEMU.

Pattern of the bug:
- A fixed 64-byte stack buffer is filled using count.
- If count > 64, the code still does buf[count] = '\0', causing an
- out-of-bounds write on the stack.

Steps for reproduce:
- Opens the device node.
- Writes 128 bytes of A to it.
- This overflows the 64-byte stack buffer and KASAN reports the OOB.

Found via static analysis. This is similar to the
commit da9374819e ("iio: backend: fix out-of-bound write")

Fixes: b1c5d68ea6 ("iio: dac: ad3552r-hs: add support for internal ramp")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-30 10:32:23 +01:00
arch x86: make page fault handling disable interrupts properly 2026-01-30 10:32:22 +01:00
block block: zero non-PI portion of auto integrity buffer 2026-01-23 11:21:16 +01:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec 2026-01-30 10:32:12 +01:00
Documentation fou: Don't allow 0 for FOU_ATTR_IPPROTO. 2026-01-30 10:32:12 +01:00
drivers iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source 2026-01-30 10:32:23 +01:00
fs fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes() 2026-01-30 10:32:15 +01:00
include mm/hugetlb: fix hugetlb_pmd_shared() 2026-01-30 10:32:15 +01:00
init printk changes for 6.18 2025-10-04 11:13:11 -07:00
io_uring io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop 2026-01-30 10:32:15 +01:00
ipc namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
kernel panic: only warn about deprecated panic_print on write access 2026-01-30 10:32:22 +01:00
lib lib/buildid: use __kernel_read() for sleepable context 2026-01-23 11:21:25 +01:00
LICENSES LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 2025-07-24 11:15:39 +02:00
mm migrate: correct lock ordering for hugetlb file folios 2026-01-30 10:32:22 +01:00
net net/sched: act_ife: avoid possible NULL deref 2026-01-30 10:32:21 +01:00
rust rust: bitops: fix missing _find_* functions on 32-bit ARM 2026-01-23 11:21:12 +01:00
samples samples/ftrace: Adjust LoongArch register restore order in direct calls 2026-01-08 10:17:11 +01:00
scripts kconfig: fix static linking of nconf 2026-01-30 10:32:16 +01:00
security keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal 2026-01-30 10:32:22 +01:00
sound ALSA: usb: Increase volume range that triggers a warning 2026-01-30 10:32:17 +01:00
tools vsock/test: fix seqpacket message bounds test 2026-01-30 10:32:21 +01:00
usr gen_init_cpio: Ignore fsync() returning EINVAL on pipes 2025-10-07 09:53:05 -07:00
virt KVM: Fix last_boosted_vcpu index assignment bug 2026-01-02 12:57:21 +01:00
.clang-format memblock: drop for_each_free_mem_pfn_range_in_zone_from() 2025-09-14 08:49:03 +03:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: remove Alyssa Rosenzweig 2025-09-18 21:17:31 +02:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: ignore compile_commands.json globally 2025-08-12 15:53:55 -07:00
.mailmap 8 hotfixes. 4 are cc:stable, 7 are against mm/. 2025-11-26 12:38:05 -08:00
.pylintrc tools: docs: parse-headers.py: move it from sphinx dir 2025-08-29 15:54:42 -06:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: mark ISDN subsystem as orphan 2025-10-27 17:49:45 -07:00
Kbuild sched: Make migrate_{en,dis}able() inline 2025-09-25 09:57:16 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS soc: fixes for 6.18, part 4 2025-11-28 09:57:31 -08:00
Makefile Linux 6.18.7 2026-01-23 11:21:37 +01:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.