kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Denis Arefev 9a6550bbe4 ubi: Add a check for ubi_num 
commit 97bbf9e312 upstream.

Added a check for ubi_num for negative numbers
If the variable ubi_num takes negative values then we get:

qemu-system-arm ... -append "ubi.mtd=0,0,0,-22222345" ...
[    0.745065]  ubi_attach_mtd_dev from ubi_init+0x178/0x218
[    0.745230]  ubi_init from do_one_initcall+0x70/0x1ac
[    0.745344]  do_one_initcall from kernel_init_freeable+0x198/0x224
[    0.745474]  kernel_init_freeable from kernel_init+0x18/0x134
[    0.745600]  kernel_init from ret_from_fork+0x14/0x28
[    0.745727] Exception stack(0x90015fb0 to 0x90015ff8)

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 83ff59a066 ("UBI: support ubi_num on mtd.ubi command line")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-02-17 09:40:27 +01:00
..
accel accel/qaic: Fix the for loop used to walk SG table 2024-11-01 01:58:21 +01:00
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:11:18 +02:00
acpi ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read() 2025-02-17 09:40:13 +01:00
amba amba: bus: fix refcount leak 2023-08-22 15:50:57 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:11:41 +02:00
ata ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() 2025-02-01 18:37:52 +01:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:33:18 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:54:39 +02:00
base driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() 2025-02-08 09:52:27 +01:00
bcma bcma: Add explicit of_device.h include 2023-04-14 15:32:56 +03:00
block nbd: don't allow reconnect after disconnect 2025-02-08 09:51:42 +01:00
bluetooth Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming 2025-02-08 09:52:31 +01:00
bus of: remove internal arguments from of_property_for_each_u32() 2025-02-08 09:51:51 +01:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-11-01 01:58:25 +01:00
cdx cdx: Explicitly include correct DT includes 2023-08-04 16:21:20 +02:00
char ipmi: ssif_bmc: Fix new request loss when bmc ready for a response 2025-02-08 09:51:55 +01:00
clk clk: mediatek: mt2701-mm: add missing dummy clk 2025-02-17 09:40:20 +01:00
clocksource of: remove internal arguments from of_property_for_each_u32() 2025-02-08 09:51:51 +01:00
comedi comedi: Flush partial mappings in error case 2024-12-09 10:32:44 +01:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter counter: ti-ecap-capture: Add check for clk_enable() 2024-12-09 10:32:37 +01:00
cpufreq cpufreq: s3c64xx: Fix compilation warning 2025-02-17 09:40:14 +01:00
cpuidle cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu 2025-01-17 13:36:16 +01:00
crypto crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() 2025-02-08 09:52:06 +01:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:58:46 +01:00
dax dax: delete a stale directory pmem 2024-12-09 10:32:21 +01:00
dca Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:14:15 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-11-09 15:12:37 +01:00
dma dmaengine: ti: edma: fix OF node reference leaks in edma_driver 2025-02-08 09:52:28 +01:00
dma-buf udmabuf: also check for F_SEAL_FUTURE_WRITE 2024-12-27 13:58:56 +01:00
edac EDAC/amd64: Simplify ECC check on unified memory controllers 2024-12-27 13:58:50 +01:00
eisa EISA: Replace all non-returning strlcpy with strscpy 2023-07-27 10:04:42 -07:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:12:27 +02:00
firewire firewire: core: correct range of block for case of switch statement 2024-10-04 16:29:28 +02:00
firmware efi: libstub: Use '-std=gnu11' to fix build with GCC 15 2025-02-17 09:40:20 +01:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:12:23 +02:00
fsi fsi: i2cr: Switch to use struct i2c_driver's .probe() 2023-08-22 15:51:33 +02:00
gnss driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
gpio gpio: pca953x: Improve interrupt support 2025-02-17 09:40:13 +01:00
gpu drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes 2025-02-17 09:40:18 +01:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
hid HID: hid-sensor-hub: don't use stale platform-data on remove 2025-02-17 09:40:21 +01:00
hsi hsi: omap_ssi: Explicitly include correct DT includes 2023-07-31 23:17:57 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:59:08 +01:00
hv Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet 2024-12-27 13:58:54 +01:00
hwmon hwmon: (drivetemp) Set scsi command timeout to 10s 2025-02-01 18:37:51 +01:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:54:43 +02:00
hwtracing coresight: tmc: sg: Do not leak sg_table 2024-10-04 16:29:40 +02:00
i2c i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz 2025-02-17 09:40:08 +01:00
i3c i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition 2025-02-08 09:52:22 +01:00
idle x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram 2024-01-25 15:35:12 -08:00
iio of: remove internal arguments from of_property_for_each_u32() 2025-02-08 09:51:51 +01:00
infiniband RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" 2025-02-08 09:52:22 +01:00
input Input: xpad - add support for wooting two he (arm) 2025-02-01 18:37:56 +01:00
interconnect interconnect: icc-clk: Add missed num_nodes initialization 2024-10-04 16:29:40 +02:00
iommu iommu/arm-smmu-v3: Clean up more on probe failure 2025-02-17 09:40:09 +01:00
ipack tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
irqchip of: remove internal arguments from of_property_for_each_u32() 2025-02-08 09:51:51 +01:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-08-19 06:04:28 +02:00
leds leds: lp8860: Write full EEPROM, not only half of it 2025-02-17 09:40:14 +01:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:54:02 +02:00
mailbox mailbox: pcc: Check before sending MCTP PCC response ACK 2025-01-09 13:31:45 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:20:05 +00:00
md dm-crypt: track tag_offset in convert_context 2025-02-17 09:40:25 +01:00
media Revert "media: uvcvideo: Require entities to have a non-zero unique ID" 2025-02-17 09:40:25 +01:00
memory memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() 2025-02-08 09:52:14 +01:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-06-12 15:16:19 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-09 10:32:18 +01:00
mfd mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id 2025-02-17 09:40:07 +01:00
misc drivers/card_reader/rtsx_usb: Restore interrupt based detection 2025-02-08 09:52:36 +01:00
mmc mmc: sdhci-msm: Correctly set the load for the regulator 2025-02-17 09:40:09 +01:00
most staging: most: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
mtd ubi: Add a check for ubi_num 2025-02-17 09:40:27 +01:00
mux mux: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
net usbnet: ipheth: document scope of NCM implementation 2025-02-17 09:40:23 +01:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:28:28 +02:00
ntb ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition 2024-10-17 15:24:18 +02:00
nubus nubus: Don't list slot resources by default 2023-05-22 13:51:56 +02:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 20:00:13 +01:00
nvme nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk 2025-02-17 09:40:26 +01:00
nvmem nvmem: u-boot-env: error if NVMEM device is too small 2024-09-18 19:24:04 +02:00
of of: reserved-memory: Fix using wrong number of cells to get property 'alignment' 2025-02-17 09:40:21 +01:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-08 09:51:55 +01:00
parisc Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
parport parport: Proper fix for array out-of-bounds access 2024-10-22 15:46:33 +02:00
pci PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() 2025-02-17 09:40:26 +01:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:11:31 +02:00
peci Update peci-next for v6.6-rc1 2023-08-08 10:53:30 +02:00
perf perf/arm-cmn: Ensure port and device id bits are set properly 2024-12-09 10:32:57 +01:00
phy phy: rockchip: naneng-combphy: fix phy reset 2025-01-02 10:32:02 +01:00
pinctrl pinctrl: amd: Take suspend type into consideration which pins are non-wake 2025-02-08 09:52:08 +01:00
platform platform/x86: acer-wmi: Ignore AC events 2025-02-17 09:40:10 +01:00
pmdomain pmdomain: imx8mp-blk-ctrl: add missing loop break condition 2025-01-23 17:21:17 +01:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:14:15 +00:00
power power: supply: gpio-charger: Fix set charge current limits 2025-01-02 10:32:10 +01:00
powercap powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() 2024-11-01 01:58:31 +01:00
pps pps: Fix a use-after-free 2025-02-08 09:52:38 +01:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp pps: Fix a use-after-free 2025-02-08 09:52:38 +01:00
pwm pwm: stm32: Add check for clk_enable() 2025-02-08 09:52:02 +01:00
rapidio Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
ras ras/debugfs: Fix error checking for debugfs_create_dir() 2023-05-16 21:12:23 +02:00
regulator regulator: core: Add missing newline character 2025-02-08 09:52:29 +01:00
remoteproc remoteproc: core: Fix ida_free call while not allocated 2025-02-08 09:52:37 +01:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-04 16:29:04 +02:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-09 10:32:29 +01:00
rtc rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr() 2025-02-08 09:52:28 +01:00
s390 net/smc: compatible with 128-bits extended GID of virtual ISM device 2024-12-14 19:59:36 +01:00
sbus sbus: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
scsi scsi: storvsc: Set correct data length for sending SCSI command without payload 2025-02-17 09:40:27 +01:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-09 10:33:00 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 12:02:33 +02:00
soc soc: qcom: socinfo: Avoid out of bounds read of serial number 2025-02-17 09:40:24 +01:00
soundwire soundwire: cadence: re-check Peripheral status with delayed_work 2024-10-17 15:24:18 +02:00
spi spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors 2025-02-08 09:52:22 +01:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:38:40 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:33:22 +02:00
staging staging: media: max96712: fix kernel oops when removing module 2025-02-08 09:52:38 +01:00
target scsi: target: core: Fix null-ptr-deref in target_alloc_device() 2024-11-01 01:58:24 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:50:53 +02:00
thermal thermal: of: fix OF node leak in of_thermal_zone_find() 2025-01-17 13:36:18 +01:00
thunderbolt thunderbolt: Don't display nvm_version unless upgrade supported 2025-01-09 13:31:49 +01:00
tty serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use 2025-02-17 09:40:24 +01:00
ufs scsi: ufs: qcom: Fix crypto key eviction 2025-02-17 09:40:27 +01:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:11:41 +02:00
usb usb: gadget: f_tcm: Don't prepare BOT write request twice 2025-02-17 09:40:22 +01:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-09 10:32:30 +01:00
vfio iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() 2025-02-08 09:52:22 +01:00
vhost vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 2024-10-10 11:58:08 +02:00
video fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() 2025-02-08 09:52:21 +01:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:12:09 +02:00
virtio virtio_ring: fix KMSAN error for premapped mode 2024-09-12 11:11:36 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe() 2025-02-08 09:52:25 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-09 10:32:39 +01:00
zorro zorro: Include zorro.h in names.c 2023-08-21 13:27:44 +02:00
Kconfig Merge patch series "Add non-coherent DMA support for AX45MP" 2023-09-08 11:24:34 -07:00
Makefile pmdomain: Rename the genpd subsystem to pmdomain 2023-09-13 11:09:21 +02:00