kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Bui Quang Minh e194787631 bna: ensure the copied buf is NUL terminated 
[ Upstream commit 8c34096c7f ]

Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
userspace to that buffer. Later, we use sscanf on this buffer but we don't
ensure that the string is terminated inside the buffer, this can lead to
OOB read when using sscanf. Fix this issue by using memdup_user_nul
instead of memdup_user.

Fixes: 7afc5dbde0 ("bna: Add debugfs interface.")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-2-f1f1b53a10f4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-05-17 12:02:02 +02:00
..
accel accel/ivpu: Fix deadlock in context_xa 2024-04-17 11:19:34 +02:00
accessibility speakup: Avoid crash on very long word 2024-04-27 17:11:40 +02:00
acpi ACPI: CPPC: Fix access width used for PCC registers 2024-05-02 16:32:46 +02:00
amba amba: bus: fix refcount leak 2023-08-22 15:50:57 +02:00
android binder: check offset alignment in binder_get_object() 2024-04-27 17:11:38 +02:00
ata ata: libata-scsi: Fix ata_scsi_dev_rescan() error path 2024-04-17 11:19:25 +02:00
atm atm: idt77252: fix a memleak in open_card_ubr0 2024-02-16 19:10:49 +01:00
auxdisplay drm for 6.6-rc1 2023-08-30 13:34:34 -07:00
base regmap: Add regmap_read_bypassed() 2024-05-17 12:01:59 +02:00
bcma bcma: Add explicit of_device.h include 2023-04-14 15:32:56 +03:00
block aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts 2024-03-26 18:19:19 -04:00
bluetooth Bluetooth: qca: add support for QCA2066 2024-05-17 12:01:56 +02:00
bus bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state 2024-04-13 13:07:38 +02:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom cdrom/gdrom: Fix build error 2023-06-29 08:09:31 -06:00
cdx cdx: Explicitly include correct DT includes 2023-08-04 16:21:20 +02:00
char random: handle creditable entropy from atomic process context 2024-04-27 17:11:30 +02:00
clk clk: mediatek: Do a runtime PM get on controllers during probe 2024-04-27 17:11:37 +02:00
clocksource clocksource/drivers/arm_global_timer: Fix maximum prescaler value 2024-04-03 15:28:50 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:11:39 +02:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter First set of Counter fixes for 6.6 2023-10-02 13:13:15 +02:00
cpufreq cpufreq: Don't unregister cpufreq cooling on CPU hotplug 2024-04-13 13:07:32 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:07:29 +02:00
crypto crypto: sun8i-ce - Fix use after free in unprepare 2024-04-03 15:28:40 +02:00
cxl cxl/core: Fix potential payload size confusion in cxl_mem_get_poison() 2024-05-02 16:32:35 +02:00
dax mm: remove enum page_entry_size 2023-08-24 16:20:30 -07:00
dca Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:14:15 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-11-09 15:12:37 +01:00
dma dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" 2024-05-17 12:01:55 +02:00
dma-buf dma-buf: Fix NULL pointer dereference in sanitycheck() 2024-04-10 16:35:40 +02:00
edac EDAC/thunderx: Fix possible out-of-bounds string access 2024-01-25 15:35:12 -08:00
eisa EISA: Replace all non-returning strlcpy with strscpy 2023-07-27 10:04:42 -07:00
extcon extcon: fix possible name leak in extcon_dev_register() 2024-02-05 20:14:31 +00:00
firewire firewire: ohci: prevent leak of left-over IRQ on unbind 2024-04-03 15:28:41 +02:00
firmware firmware: arm_scmi: Make raw debugfs entries non-seekable 2024-04-17 11:19:27 +02:00
fpga fpga: Fix memory leak for fpga_region_test_class_find() 2023-10-24 19:32:39 +02:00
fsi fsi: i2cr: Switch to use struct i2c_driver's .probe() 2023-08-22 15:51:33 +02:00
gnss driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
gpio gpio: tegra186: Fix tegra186_gpio_is_accessible() check 2024-05-02 16:32:37 +02:00
gpu drm/amdgpu: Fix leak when GPU memory allocation fails 2024-05-02 16:32:45 +02:00
greybus greybus: Use alloc_ordered_workqueue() to create ordered workqueues 2023-05-08 13:52:27 -10:00
hid HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up 2024-05-02 16:32:44 +02:00
hsi hsi: omap_ssi: Explicitly include correct DT includes 2023-07-31 23:17:57 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:59:08 +01:00
hv x86/hyperv: Use per cpu initial stack for vtl context 2024-03-26 18:20:06 -04:00
hwmon hwmon: (amc6821) add of_match table 2024-04-03 15:28:28 +02:00
hwspinlock hwspinlock: qcom: add missing regmap config for SFPB MMIO implementation 2023-07-17 11:49:18 -07:00
hwtracing hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() 2024-03-26 18:20:06 -04:00
i2c i2c: smbus: fix NULL function pointer dereference 2024-05-02 16:32:49 +02:00
i3c i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling 2024-03-26 18:20:01 -04:00
idle x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram 2024-01-25 15:35:12 -08:00
iio iio: imu: inv_mpu6050: fix FIFO parsing when empty 2024-04-03 15:28:45 +02:00
infiniband RDMA/mlx5: Fix port number for counter query in multi-port configuration 2024-04-27 17:11:34 +02:00
input Input: xpad - add support for Snakebyte GAMEPADs 2024-04-13 13:07:37 +02:00
interconnect interconnect: Don't access req_list while it's being manipulated 2024-04-27 17:11:37 +02:00
iommu iommu/vt-d: Allocate local memory for page request queue 2024-04-17 11:19:33 +02:00
ipack tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
irqchip irqchip/gic-v3-its: Prevent double free on error 2024-05-02 16:32:45 +02:00
isdn isdn: mISDN: hfcsusb: Spelling fix in comment 2023-10-23 09:39:46 +01:00
leds leds: trigger: netdev: Fix kernel panic on interface rename trig notify 2024-04-03 15:28:27 +02:00
macintosh powerpc updates for 6.6 2023-08-31 12:43:10 -07:00
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-05 20:14:31 +00:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:20:05 +00:00
md raid1: fix use-after-free for original bio in raid1_write_request() 2024-04-17 11:19:25 +02:00
media media: videobuf2: request more buffers for vb2_read 2024-04-27 17:11:30 +02:00
memory memory: tegra: Correct DLA client names 2024-03-26 18:19:32 -04:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-06-12 15:16:19 +02:00
message scsi: message: fusion: Add HAS_IOPORT dependencies 2023-05-31 19:59:26 -04:00
mfd mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults 2024-03-26 18:19:55 -04:00
misc eeprom: at24: fix memory corruption race condition 2024-05-17 12:01:56 +02:00
mmc mmc: sdhci-msm: pervent access to suspended controller 2024-05-02 16:32:43 +02:00
most staging: most: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
mtd mtd: limit OTP NVMEM cell parse to non-NAND devices 2024-05-17 12:01:55 +02:00
mux mux: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
net bna: ensure the copied buf is NUL terminated 2024-05-17 12:02:02 +02:00
nfc NFC: trf7970a: disable all regulators on removal 2024-05-02 16:32:36 +02:00
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:19:48 -04:00
nubus nubus: Don't list slot resources by default 2023-05-22 13:51:56 +02:00
nvdimm nd_btt: Make BTT lanes preemptible 2023-11-20 11:59:19 +01:00
nvme nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH 2024-05-17 12:01:59 +02:00
nvmem nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
of of: module: prevent NULL pointer dereference in vsnprintf() 2024-04-10 16:36:06 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:19:40 -04:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:18:52 -08:00
parport parport: parport_serial: Add Brainboxes device IDs and geometry 2024-01-20 11:51:48 +01:00
pci PCI/ASPM: Fix deadlock when enabling ASPM 2024-04-27 17:11:44 +02:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2023-11-20 11:59:31 +01:00
peci Update peci-next for v6.6-rc1 2023-08-08 10:53:30 +02:00
perf drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09 2024-04-13 13:07:36 +02:00
phy phy: qcom: qmp-combo: fix VCO div offset on v5_5nm and v6 2024-05-02 16:32:49 +02:00
pinctrl pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() 2024-05-17 12:01:58 +02:00
platform platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes 2024-04-27 17:11:37 +02:00
pmdomain pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain 2024-04-13 13:07:30 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:14:15 +00:00
power power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator 2024-05-17 12:01:58 +02:00
powercap powercap: intel_rapl_tpmi: Fix System Domain probing 2024-04-03 15:28:19 +02:00
pps driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: annotate data-race around q->head and q->tail 2023-11-28 17:19:51 +00:00
pwm pwm: img: fix pwm clock lookup 2024-04-03 15:28:52 +02:00
rapidio Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
ras ras/debugfs: Fix error checking for debugfs_create_dir() 2023-05-16 21:12:23 +02:00
regulator regulator: mt6360: De-capitalize devicetree regulator subnodes 2024-05-17 12:01:58 +02:00
remoteproc remoteproc: virtio: Fix wdg cannot recovery remote processor 2024-04-03 15:28:16 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-20 11:51:44 +01:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-01-31 16:18:50 -08:00
rtc nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
s390 s390/cio: fix race condition during online processing 2024-04-27 17:11:34 +02:00
sbus sbus: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
scsi scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING 2024-04-27 17:11:30 +02:00
sh sh: intc: move to use bus_get_dev_root() 2023-03-17 15:29:55 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: core: Remove usage of the deprecated ida_simple_xx() API 2024-04-03 15:28:28 +02:00
soc soc: fsl: qbman: Use raw spinlock for cgr_lock 2024-04-03 15:28:32 +02:00
soundwire soundwire: amd: fix for wake interrupt handling for clockstop mode 2024-05-02 16:32:47 +02:00
spi spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs 2024-05-17 12:02:01 +02:00
spmi spmi: mediatek: Fix UAF on device remove 2024-02-05 20:14:32 +00:00
ssb driver core: make struct bus_type.uevent() take a const * 2023-01-27 13:45:52 +01:00
staging staging: vc04_services: fix information leak in create_component() 2024-04-03 15:28:59 +02:00
target scsi: target: pscsi: Fix bio_put() for error case 2024-03-01 13:34:59 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-03 15:28:44 +02:00
thermal thermal/of: Assume polling-delay(-passive) 0 when absent 2024-04-13 13:07:39 +02:00
thunderbolt thunderbolt: Reset only non-USB4 host routers in resume 2024-04-27 17:11:44 +02:00
tty serial: core: Fix missing shutdown and startup for serial base port 2024-04-27 17:11:39 +02:00
ufs scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5 2024-04-27 17:11:31 +02:00
uio uio: Fix use-after-free in uio_open 2024-01-20 11:51:48 +01:00
usb usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error 2024-04-27 17:11:40 +02:00
vdpa vdpa/mlx5: Allow CVQ size changes 2024-03-26 18:20:10 -04:00
vfio vfio/pds: Make sure migration file isn't accessed after reset 2024-04-03 15:28:59 +02:00
vhost vhost: Add smp_rmb() in vhost_enable_notify() 2024-04-17 11:19:35 +02:00
video fbdev: fix incorrect address computation in deferred IO 2024-05-02 16:32:46 +02:00
virt virt: sevguest: Fix passing a stack buffer as a scatterlist target 2023-11-20 11:59:30 +01:00
virtio virtio: reenable config if freezing device failed 2024-04-03 15:28:36 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: stm32_iwdg: initialize default timeout 2024-03-26 18:20:02 -04:00
xen x86/xen: attempt to inflate the memory balloon on PVH 2024-04-13 13:07:39 +02:00
zorro zorro: Include zorro.h in names.c 2023-08-21 13:27:44 +02:00
Kconfig Merge patch series "Add non-coherent DMA support for AX45MP" 2023-09-08 11:24:34 -07:00
Makefile pmdomain: Rename the genpd subsystem to pmdomain 2023-09-13 11:09:21 +02:00