Tianchu Chen d285517429 char: applicom: fix NULL pointer dereference in ac_ioctl ...

commit 82d12088c297fa1cef670e1718b3d24f414c23f7 upstream.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

In ac_ioctl, the validation of IndexCard and the check for a valid
RamIO pointer are skipped when cmd is 6. However, the function
unconditionally executes readb(apbs[IndexCard].RamIO + VERS) at the
end.

If cmd is 6, IndexCard may reference a board that does not exist
(where RamIO is NULL), leading to a NULL pointer dereference.

Fix this by skipping the readb access when cmd is 6, as this
command is a global information query and does not target a specific
board context.

Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20251128155323.a786fde92ebb926cbe96fcb1@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-11 15:21:58 +01:00

..

agp

parisc/agp: Use 64-bit LE values in SBA IOMMU PDIR table

2023-11-28 17:20:00 +00:00

hw_random

hwrng: ks-sa - fix division by zero in ks_sa_rng_init

2025-10-15 11:58:05 +02:00

ipmi

ipmi: Fix __scan_channels() failing to rescan channels

2026-01-11 15:21:51 +01:00

mwave

char/mwave: Adjust io port register size

2021-12-03 14:27:06 +01:00

tpm

tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single

2025-10-19 16:30:45 +02:00

xilinx_hwicap

xilinx_hwicap: make icap_class a static const structure

2023-06-23 10:27:23 +02:00

xillybus

char: xillybus: Check USB endpoints when probing device

2024-08-29 17:33:11 +02:00

adi.c

char: sparc64: Add privileged ADI driver

2018-06-05 11:24:55 -07:00

apm-emulation.c

apm-emulation: drop unexpected word "the" in the comments

2022-06-27 16:15:27 +02:00

applicom.c

char: applicom: fix NULL pointer dereference in ac_ioctl

2026-01-11 15:21:58 +01:00

applicom.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bsr.c

char: Explicitly include correct DT includes

2023-07-30 18:15:27 +02:00

ds1620.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

dsp56k.c

dsp56k: make dsp56k_class a static const structure

2023-06-23 10:27:08 +02:00

dtlk.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

hangcheck-timer.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 405

2019-06-05 17:37:13 +02:00

hpet.c

hpet: Support 32-bit userspace

2024-07-18 13:21:19 +02:00

Kconfig

char: add HAS_IOPORT dependencies

2023-05-31 19:17:29 +01:00

lp.c

char: lp: make lp_class a static const structure

2023-06-23 10:27:11 +02:00

Makefile

char: pcmcia: remove all the drivers

2023-03-09 17:30:27 +01:00

mem.c

drivers/char/mem.c: shrink character device's devlist[] array

2023-08-24 16:25:15 -07:00

misc.c

char: misc: restrict the dynamic range to exclude reserved minors

2025-11-24 10:29:46 +01:00

mspec.c

mm: replace vma->vm_flags direct modifications with modifier calls

2023-02-09 16:51:39 -08:00

nsc_gpio.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

nvram.c

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

nwbutton.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

nwbutton.h

misc: cleanup minor number definitions in c file into miscdevice.h

2020-03-18 12:27:03 +01:00

nwflash.c

misc: move FLASH_MINOR into miscdevice.h and fix conflicts

2020-03-18 12:27:04 +01:00

pc8736x_gpio.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

powernv-op-panel.c

powerpc/powernv: Fix fall-through warning for Clang

2021-07-13 19:21:41 -05:00

ppdev.c

ppdev: Add an error check in register_device

2024-06-12 11:12:26 +02:00

ps3flash.c

powerpc/ps3: make system bus's remove and shutdown callbacks return void

2020-12-04 01:01:22 +11:00

random.c

random: handle creditable entropy from atomic process context

2024-04-27 17:11:30 +02:00

scx200_gpio.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

sonypi.c

ACPI: make remove callback of ACPI driver void

2022-11-23 19:11:22 +01:00

tlclk.c

drivers: char: tlclk.c: Avoid data race between init and interrupt handler

2020-04-23 16:55:24 +02:00

toshiba.c

module: remove never implemented MODULE_SUPPORTED_DEVICE

2021-03-17 13:16:18 -07:00

ttyprintk.c

tty: make tty_operations::write()'s count size_t

2023-08-11 21:12:46 +02:00

uv_mmtimer.c

…

virtio_console.c

virtio_console: fix missing byte order handling for cols and rows

2025-05-02 07:50:45 +02:00