Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Ashutosh Dixit 72aaf646fb misc: mic: Fix for double fetch security bug in VOP driver ... commit 9bf292bfca upstream. The MIC VOP driver does two successive reads from user space to read a variable length data structure. Kernel memory corruption can result if the data structure changes between the two reads. This patch disallows the chance of this happening. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116651 Reported by: Pengfei Wang <wpengfeinudt@gmail.com> Reviewed-by: Sudeep Dutt <sudeep.dutt@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [bwh: Backported to 3.16: - Adjust filename, context - goto exit on failure] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2016-08-22 22:38:29 +01:00
..
accessibility	printk: move braille console support into separate braille.[ch] files	2013-07-31 14:41:03 -07:00
acpi	ACPI / processor: Avoid reserving IO regions too early	2016-08-22 22:38:07 +01:00
amba	ARM: SoC: driver changes	2014-04-05 15:37:40 -07:00
ata	scsi: fix race between simultaneous decrements of ->host_failed	2016-08-22 22:38:13 +01:00
atm	atm: fore200e.c: Cleaning up uninitialized variables	2014-06-02 17:11:03 -07:00
auxdisplay	auxdisplay: ks0108: fix refcount	2015-09-28 10:21:35 +01:00
base	isa: Call isa_bus_init before dependent ISA bus drivers register	2016-08-22 22:38:16 +01:00
bcma	bcma: gpio: register 32 GPIOs on BCM5357	2014-03-27 14:20:04 -04:00
block	rbd: fix rbd map vs notify races	2016-06-15 21:29:28 +01:00
bluetooth	Bluetooth: vhci: Fix race at creating hci device	2016-08-22 22:37:50 +01:00
bus	bus: imx-weim: Take the 'status' property value into account	2016-05-01 00:05:57 +02:00
cdrom	Merge branch 'for-linus' of git://git.kernel.dk/linux-block	2014-06-11 08:41:17 -07:00
char	hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default	2016-08-22 22:38:16 +01:00
clk	clk: xgene: Add missing parenthesis when clearing divider value	2016-05-01 00:05:53 +02:00
clocksource	clocksource/drivers/vt8500: Increase the minimum delta	2016-02-02 19:09:28 +00:00
connector	connector: bump skb->users before callback invocation	2016-01-28 10:14:29 +00:00
cpufreq	cpufreq: intel_pstate: Fix ->set_policy() interface for no_turbo	2016-08-22 22:38:10 +01:00
cpuidle	cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter()	2016-08-22 22:38:01 +01:00
crypto	crypto: ux500 - memmove the right size	2016-08-22 22:38:14 +01:00
dca	dca: convert to idr_alloc()	2013-02-27 19:10:15 -08:00
devfreq	PM / devfreq: remove checks for CONFIG_EXYNOS_ASV	2014-05-24 22:33:51 +09:00
dio	m68k: don't export static inline functions	2009-12-06 11:18:28 +01:00
dma	dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer	2016-03-04 10:26:40 +00:00
edac	EDAC: Increment correct counter in edac_inc_ue_error()	2016-08-22 22:37:51 +01:00
eisa	Revert "EISA: Initialize device before its resources"	2014-01-17 14:57:29 -07:00
extcon	extcon: palmas: Use devm_extcon_dev_allocate for extcon_dev	2014-04-29 09:52:12 +09:00
firewire	firewire: ohci: fix JMicron JMB38x IT context discovery	2015-12-13 17:49:09 +00:00
firmware	efi: Fix out-of-bounds read in variable_matches()	2016-06-15 21:29:26 +01:00
fmc	Merge 3.14-rc5 into char-misc-next	2014-03-02 19:53:09 -08:00
gpio	gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings	2016-08-22 22:38:10 +01:00
gpu	drm/i915/ilk: Don't disable SSC source if it's in use	2016-08-22 22:38:15 +01:00
hid	HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands	2016-08-22 22:38:20 +01:00
hsi	hsi: omap_ssi_port: Prevent warning if cawake_gpio is not defined.	2015-12-13 17:49:33 +00:00
hv	Drivers: hv: vmbus: Fix signaling logic in hv_need_to_signal_on_read()	2016-06-15 21:29:29 +01:00
hwmon	hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated	2016-05-01 00:06:06 +02:00
hwspinlock	A single patch from Vincent extending OMAP's hwspinlock support to OMAP5.	2013-05-07 14:01:27 -07:00
i2c	i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared	2016-06-15 21:29:26 +01:00
ide	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide	2014-07-21 22:44:24 -07:00
idle	intel_idle: fix IVT idle state table setting	2014-04-21 23:36:07 +02:00
iio	iio:ad7266: Fix probe deferral for vref	2016-08-22 22:38:21 +01:00
infiniband	IB/mlx4: Fix memory leak if QP creation failed	2016-08-22 22:38:19 +01:00
input	Input: elantech - add more IC body types to the list	2016-08-22 22:38:19 +01:00
iommu	iommu/vt-d: Improve fault handler error messages	2016-08-22 22:37:48 +01:00
ipack	ipack: convert bus code to use dev_groups	2013-10-16 18:40:57 -07:00
irqchip	irqchip/gic: Ensure ordering between read of INTACK and shared data	2016-08-22 22:37:57 +01:00
isdn	ser_gigaset: fix deallocation of platform device structure	2016-01-25 10:43:51 +00:00
leds	leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger	2015-07-09 14:36:01 +01:00
lguest	lguest: fix out-by-one error in address checking.	2015-06-03 14:30:03 +01:00
macintosh	windfarm: decrement client count when unregistering	2015-09-30 13:20:39 +01:00
mailbox	drivers/mailbox/omap: make mbox->irq signed for error handling	2014-01-23 16:36:53 -08:00
mcb	mcb: Fixed bar number assignment for the gdd	2016-08-22 22:37:53 +01:00
md	md: multipath: don't hardcopy bio in .make_request path	2016-05-01 00:06:00 +02:00
media	uvc: Forward compat ioctls to their handlers directly	2016-08-22 22:38:10 +01:00
memory	memory: mvebu-devbus: add a devbus, keep-config property	2014-04-29 13:17:10 +00:00
memstick	memstick: mspro_block: add missing curly braces	2015-05-06 11:33:10 +01:00
message	mptfusion: enable no_write_same for vmware scsi disks	2014-10-30 09:40:12 -07:00
mfd	mfd: omap-usb-tll: Fix scheduling while atomic BUG	2016-08-22 22:38:11 +01:00
misc	misc: mic: Fix for double fetch security bug in VOP driver	2016-08-22 22:38:29 +01:00
mmc	mmc: longer timeout for long read time quirk	2016-08-22 22:38:04 +01:00
mtd	ubi: Make recover_peb power cut aware	2016-08-22 22:38:18 +01:00
net	net: bcmsysport: Device stats are unsigned long	2016-08-22 22:38:26 +01:00
nfc	NFC: microread: Potential overflows in microread_target_discovered()	2014-10-05 13:41:05 -07:00
ntb	ntb: Use pci_enable_msix_range() instead of pci_enable_msix()	2014-04-07 10:59:20 -07:00
nubus	kernel/printk: use symbolic defines for console loglevels	2014-06-04 16:54:17 -07:00
of	of: irq: fix of_irq_get[_byname]() kernel-doc	2016-08-22 22:38:08 +01:00
oprofile	oprofile, nmi-timer: Fix CPU hotplug callback registration	2014-03-20 13:43:46 +01:00
parisc	parisc iommu: fix panic due to trying to allocate too large region	2016-01-18 22:27:29 +00:00
parport	parport: fix menu breakage	2014-07-25 18:00:23 -07:00
pci	PCI: Disable all BAR sizing for devices with non-compliant BARs	2016-08-22 22:38:00 +01:00
pcmcia	Disable write buffering on Toshiba ToPIC95	2015-07-15 10:00:33 +01:00
phy	phy: twl4030-usb: Relase usb phy on unload	2016-02-25 10:34:54 +00:00
pinctrl	pinctrl: single: Fix missing flush of posted write for a wakeirq	2016-08-22 22:38:17 +01:00
platform	ideapad-laptop: Add ideapad Y700 (15) to the no_hw_rfkill DMI list	2016-05-01 00:06:04 +02:00
pnp	ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage	2015-07-15 10:01:34 +01:00
power	power: test_power: correctly handle empty writes	2016-02-02 19:47:55 +00:00
powercap	powercap / RAPL: fix BIOS lock check	2016-01-25 10:43:36 +00:00
pps	drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr	2013-11-13 12:09:35 +09:00
ps3	ps3-vuart: don't use PREPARE_WORK	2014-03-07 10:24:48 -05:00
ptp	ptp: ptp_pch depends on x86_32	2014-06-17 15:43:48 -07:00
pwm	pwm: Fix period and polarity in pwm_get() for non-perfect matches	2014-10-05 13:40:52 -07:00
rapidio	rapidio/tsi721_dma: fix failure to obtain transaction descriptor	2014-07-30 17:16:13 -07:00
regulator	regulator: s2mps11: Fix invalid selector mask and voltages for buck9	2016-06-15 21:29:21 +01:00
remoteproc	remoteproc: avoid stack overflow in debugfs file	2016-01-05 12:08:23 +00:00
reset	reset: sunxi: fix spinlock initialization	2015-01-22 16:33:34 +00:00
rpmsg	A small pull request consisting of:	2013-05-07 14:02:00 -07:00
rtc	rtc: hym8563: fix invalid year calculation	2016-05-01 00:05:59 +02:00
s390	s390/sclp_ctl: fix potential information leak with /dev/sclp	2016-08-22 22:38:28 +01:00
sbus	bbc-i2c: Fix BBC I2C envctrl on SunBlade 2000	2014-08-14 10:09:44 +08:00
scsi	ipr: Clear interrupt on croc/crocodile when running with LSI	2016-08-22 22:38:23 +01:00
sfi	SFI / ACPI: Fix warnings reported during builds with W=1	2013-12-07 01:24:33 +01:00
sh	SH Driver Update for v3.16	2014-06-06 11:44:09 -07:00
sn	Drivers: misc: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
soc	soc: qcom: fix of_device_id table	2014-05-26 21:27:09 +02:00
spi	spi: sunxi: fix transfer timeout	2016-08-22 22:38:14 +01:00
spmi	spmi: pm: drop bus-level PM suspend/resume routines	2014-03-08 22:15:52 -08:00
ssb	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus	2014-01-30 17:20:32 -08:00
staging	staging: iio: accel: fix error check	2016-08-22 22:38:21 +01:00
target	target: Fix target_release_cmd_kref shutdown comp leak	2016-05-01 00:06:03 +02:00
tc	TC: Handle device_register() errors.	2014-06-26 10:48:23 +01:00
thermal	thermal: exynos: Fix unbalanced regulator disable on probe failure	2015-12-13 17:49:07 +00:00
tty	tty: vt, return error when con_startup fails	2016-08-22 22:37:54 +01:00
uio	Revert "uio: fix vma io range check in mmap"	2014-06-17 16:07:08 -07:00
usb	USB: usbfs: fix potential infoleak in devio	2016-08-22 22:38:27 +01:00
uwb	uwb: init beacon cache entry before registering uwb device	2014-10-05 13:40:58 -07:00
vfio	vfio: fix ioctl error handling	2016-03-24 10:00:54 +00:00
vhost	vhost: actually track log eventfd file	2015-08-25 10:13:39 +01:00
video	xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND"	2016-05-01 00:05:57 +02:00
virt	drivers: clean-up prom.h implicit includes	2013-10-09 20:04:04 -05:00
virtio	mm/balloon_compaction: redesign ballooned pages management	2016-06-15 21:29:35 +01:00
vlynq	drivers/vlynq/vlynq.c: fix another resource size off by 1 error	2014-01-23 16:36:55 -08:00
vme	vme_tsi148: Utilize to_pci_dev() macro	2014-04-16 14:08:37 -07:00
w1	w1_therm reference count family data	2015-07-09 14:36:07 +01:00
watchdog	watchdog: rc32434_wdt: fix ioctl error handling	2016-05-01 00:05:52 +02:00
xen	xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7	2016-08-22 22:38:26 +01:00
zorro	zorro/UAPI: Use proper types (endianness/size) in <linux/zorro.h>	2013-11-26 11:09:09 +01:00
Kconfig	soc: Introduce drivers/soc place-holder for SOC specific drivers	2014-05-23 11:37:46 -05:00
Makefile	Char / misc driver patches for 3.16-rc1	2014-06-03 08:06:56 -07:00