bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-14 21:53:21 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
90f2a76ccd37cce2530df49335bcea6cd0e23797
linux/drivers
History
Jann Horn 90f2a76ccd USB: yurex: fix out-of-bounds uaccess in read handler 
commit f1e255d60a upstream.

In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.

Fix it by using simple_read_from_buffer() instead of custom logic.

Fixes: 6bc235a2e2 ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:39:26 +02:00
..
accessibility
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
acpi
acpi: Add helper for deactivating memory region
2018-07-08 15:30:46 +02:00
amba
ARM: amba: Don't read past the end of sysfs "driver_override" buffer
2018-05-01 12:58:21 -07:00
android
ANDROID: binder: prevent transactions into own process.
2018-05-01 12:58:20 -07:00
ata
ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
2018-07-17 11:39:25 +02:00
atm
atm: zatm: fix memcmp casting
2018-07-08 15:30:52 +02:00
auxdisplay
auxdisplay: fix broken menu
2018-07-03 11:24:56 +02:00
base
PM / OPP: Update voltage in case freq == old_freq
2018-07-03 11:24:47 +02:00
bcma
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
block
drbd: fix access after free
2018-07-11 16:29:14 +02:00
bluetooth
Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
2018-07-03 11:24:49 +02:00
bus
sunxi-rsb: Include OF based modalias in device uevent
2018-01-10 09:31:19 +01:00
cdrom
cdrom: do not call check_disk_change() inside cdrom_open()
2018-05-30 07:52:34 +02:00
char
tpm: fix race condition in tpm_common_write()
2018-07-03 11:24:53 +02:00
clk
clk: at91: PLL recalc_rate() now using cached MUL and DIV values
2018-07-03 11:24:59 +02:00
clocksource
clocksource/drivers/imx-tpm: Correct some registers operation flow
2018-06-21 04:02:40 +09:00
connector
…
cpufreq
cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0
2018-07-03 11:24:56 +02:00
cpuidle
cpuidle: powernv: Fix promotion from snooze if next state disabled
2018-07-03 11:24:51 +02:00
crypto
crypto: omap-sham - fix memleak
2018-06-16 09:45:18 +02:00
dax
dax: check for QUEUE_FLAG_DAX in bdev_dax_supported()
2018-07-11 16:29:22 +02:00
dca
…
devfreq
PM / devfreq: Fix potential NULL pointer dereference in governor_store
2018-04-12 12:32:13 +02:00
dio
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
dma
dmaengine: qcom: bam_dma: get num-channels and num-ees from dt
2018-05-30 07:52:37 +02:00
dma-buf
dma-buf: remove redundant initialization of sg_table
2018-06-05 11:41:57 +02:00
edac
x86/mce/AMD, EDAC/mce_amd: Enumerate Reserved SMCA bank type
2018-04-19 08:56:20 +02:00
eisa
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
extcon
extcon: intel-cht-wc: Set direction and drv flags for V5 boost GPIO
2018-04-24 09:36:29 +02:00
firewire
firewire-ohci: work around oversized DMA reads on JMicron controllers
2018-04-26 11:02:03 +02:00
firmware
efi/libstub/arm64: Handle randomized TEXT_OFFSET
2018-06-21 04:03:01 +09:00
fmc
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
fpga
fpga-manager: altera-ps-spi: preserve nCONFIG state
2018-05-01 12:58:24 -07:00
fsi
…
gpio
gpio: No NULL owner
2018-06-16 09:45:14 +02:00
gpu
drm/udl: fix display corruption of the last line
2018-07-11 16:29:16 +02:00
hid
HID: debug: check length before copy_to_user()
2018-07-11 16:29:20 +02:00
hsi
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hv
Drivers: hv: vmbus: do not mark HV_PCIE as perf_device
2018-04-19 08:56:16 +02:00
hwmon
hwmon: (pmbus/adm1275) Accept negative page register values
2018-05-30 07:52:34 +02:00
hwspinlock
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hwtracing
intel_th: Use correct device when freeing buffers
2018-06-05 11:41:59 +02:00
i2c
i2c: viperboard: return message count on master_xfer success
2018-06-21 04:03:00 +09:00
ide
cdrom: do not call check_disk_change() inside cdrom_open()
2018-05-30 07:52:34 +02:00
idle
Revert "x86/mm: Stop calling leave_mm() in idle code"
2017-11-04 15:01:50 +01:00
iio
iio: sca3000: Fix an error handling path in 'sca3000_probe()'
2018-07-03 11:24:57 +02:00
infiniband
RDMA/mlx4: Discard unknown SQP work requests
2018-07-03 11:24:54 +02:00
input
Input: elantech - fix V4 report decoding for module with middle key
2018-07-03 11:25:04 +02:00
iommu
iommu/vt-d: fix shift-out-of-bounds in bug checking
2018-06-21 04:02:53 +09:00
ipack
…
irqchip
irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node
2018-07-03 11:24:56 +02:00
isdn
isdn: eicon: fix a missing-check bug
2018-06-11 22:49:19 +02:00
leds
leds: pm8058: Silence pointer to integer size warning
2018-03-19 08:42:50 +01:00
lightnvm
lightnvm: pblk: protect line bitmap while submitting meta io
2017-12-20 10:10:38 +01:00
macintosh
drivers: macintosh: rack-meter: really fix bogus memsets
2018-05-30 07:52:27 +02:00
mailbox
mailbox: mailbox-test: don't rely on rx_buffer content to signal data ready
2017-12-14 09:53:12 +01:00
mcb
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
md
dm: prevent DAX mounts if not supported
2018-07-11 16:29:23 +02:00
media
media: rc: mce_kbd decoder: fix stuck keys
2018-07-17 11:39:22 +02:00
memory
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
memstick
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
message
scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-05-25 16:17:47 +02:00
mfd
mfd: intel-lpss: Fix Intel Cannon Lake LPSS I2C input clock
2018-07-03 11:25:00 +02:00
misc
vmw_balloon: fix inflation with batching
2018-07-17 11:39:25 +02:00
mmc
mmc: dw_mmc: fix card threshold control configuration
2018-07-17 11:39:23 +02:00
mtd
mtd: cfi_cmdset_0002: Change erase functions to check chip good only
2018-07-11 16:29:23 +02:00
mux
mux: core: fix double get_device()
2018-01-17 09:45:27 +01:00
net
Revert "dpaa_eth: fix error in dpaa_remove()"
2018-07-11 16:29:21 +02:00
nfc
NFC: pn533: don't send USB data off of the stack
2018-06-16 09:45:15 +02:00
ntb
ntb_transport: Fix bug with max_mw_size parameter
2018-04-26 11:02:13 +02:00
nubus
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
nvdimm
linvdimm, pmem: Preserve read-only setting for pmem devices
2018-07-03 11:24:58 +02:00
nvme
nvme: Set integrity flag for user passthrough commands
2018-06-21 04:02:53 +09:00
nvmem
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
of
of: platform: stop accessing invalid dev in of_platform_device_destroy
2018-07-03 11:24:52 +02:00
oprofile
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
parisc
parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
2018-05-30 07:52:28 +02:00
parport
parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
2018-04-08 14:26:31 +02:00
pci
PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume
2018-07-03 11:24:56 +02:00
pcmcia
PCMCIA / PM: Avoid noirq suspend aborts during suspend-to-idle
2018-05-30 07:52:39 +02:00
perf
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
phy
phy: qcom-qusb2: Fix crash if nvmem cell not specified
2018-06-16 09:45:16 +02:00
pinctrl
pinctrl: devicetree: Fix pctldev pointer overwrite
2018-07-03 11:24:56 +02:00
platform
platform/x86: asus-wmi: Fix NULL pointer dereference
2018-07-08 15:30:53 +02:00
pnp
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
power
power: supply: ltc2941-battery-gauge: Fix temperature units
2018-05-30 07:52:38 +02:00
powercap
…
pps
…
ps3
…
ptp
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pwm
pwm: lpss: platform: Save/restore the ctrl register over a suspend/resume
2018-07-03 11:25:03 +02:00
rapidio
drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()'
2017-12-14 09:53:08 +01:00
ras
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
regulator
regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()'
2018-05-30 07:52:41 +02:00
remoteproc
remoteproc: qcom: Fix potential device node leaks
2018-06-21 04:02:48 +09:00
reset
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
rpmsg
rpmsg: smd: do not use mananged resources for endpoints and channels
2018-07-03 11:24:59 +02:00
rtc
rtc: sun6i: Fix bit_idx value for clk_register_gate
2018-07-03 11:24:59 +02:00
s390
s390/dasd: use blk_mq_rq_from_pdu for per request data
2018-07-08 15:30:51 +02:00
sbus
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
scsi
scsi: sg: mitigate read/write abuse
2018-07-11 16:29:14 +02:00
sfi
…
sh
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
sn
…
soc
soc: rockchip: power-domain: Fix wrong value when power up pd with writemask
2018-07-03 11:24:51 +02:00
spi
spi: bcm2835aux: ensure interrupts are enabled for shared handler
2018-06-21 04:02:54 +09:00
spmi
…
ssb
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
staging
staging: r8822be: Fix RTL8822be can't find any wireless AP
2018-07-17 11:39:24 +02:00
target
scsi: target: Fix truncated PR-in ReadKeys response
2018-07-11 16:29:14 +02:00
tc
…
tee
tee: check shm references are consistent in offset/size
2018-06-21 04:02:54 +09:00
thermal
thermal: bcm2835: Stop using printk format %pCr
2018-07-03 11:24:48 +02:00
thunderbolt
thunderbolt: Prevent crash when ICM firmware is not running
2018-04-24 09:36:29 +02:00
tty
vt: prevent leaking uninitialized data to userspace via /dev/vcs*
2018-07-08 15:30:47 +02:00
uio
uio_hv_generic: check that host supports monitor page
2018-04-12 12:32:19 +02:00
usb
USB: yurex: fix out-of-bounds uaccess in read handler
2018-07-17 11:39:26 +02:00
uwb
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
vfio
vfio: Use get_user_pages_longterm correctly
2018-07-11 16:29:15 +02:00
vhost
vhost: fix info leak due to uninitialized memory
2018-06-26 08:06:33 +08:00
video
video: uvesafb: Fix integer overflow in allocation
2018-07-03 11:25:02 +02:00
virt
…
virtio
virtio_ring: fix num_free handling in error case
2018-03-15 10:54:32 +01:00
vlynq
…
vme
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
w1
1wire: family module autoload fails because of upper/lower case mismatch.
2018-07-03 11:24:47 +02:00
watchdog
watchdog: asm9260_wdt: fix error handling in asm9260_wdt_probe()
2018-05-30 07:52:36 +02:00
xen
xen: Remove unnecessary BUG_ON from __unbind_from_irq()
2018-07-03 11:25:03 +02:00
zorro
zorro: Set up z->dev.dma_mask for the DMA API
2018-05-30 07:52:30 +02:00
Kconfig
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Makefile
usb: build drivers/usb/common/ when USB_SUPPORT is set
2018-02-25 11:07:53 +01:00