shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-04-03 11:43:03 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
24cc679abbf31477d0cc6106ec83c2fbae6b3cdf
linux/drivers
History
Tetsuo Handa 24cc679abb Input: iforce - invert valid length check when fetching device IDs 
commit b8ebf25099 upstream.

syzbot is reporting uninitialized value at iforce_init_device() [1], for
commit 6ac0aec6b0 ("Input: iforce - allow callers supply data buffer
when fetching device IDs") is checking that valid length is shorter than
bytes to read. Since iforce_get_id_packet() stores valid length when
returning 0, the caller needs to check that valid length is longer than or
equals to bytes to read.

Reported-by: syzbot <syzbot+4dd880c1184280378821@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6ac0aec6b0 ("Input: iforce - allow callers supply data buffer when fetching device IDs")
Link: https://lore.kernel.org/r/531fb432-7396-ad37-ecba-3e42e7f56d5c@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-25 17:45:52 +01:00
..
accessibility
speakup: fix a segfault caused by switching consoles
2022-11-25 17:45:50 +01:00
acpi
ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
2022-11-10 18:14:22 +01:00
amba
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
android
binder: fix UAF of alloc->vma in race with munmap()
2022-11-10 18:14:25 +01:00
ata
ata: libata-transport: fix error handling in ata_tdev_add()
2022-11-25 17:45:45 +01:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:38:02 +02:00
auxdisplay
auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-18 14:04:24 +01:00
base
PM: domains: Fix handling of unavailable/disabled idle states
2022-11-03 23:57:53 +09:00
bcma
bcma: Fix memory leak for internally-handled cores
2021-09-15 09:50:45 +02:00
block
drbd: use after free in drbd_create_device()
2022-11-25 17:45:47 +01:00
bluetooth
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
2022-10-26 13:25:21 +02:00
bus
bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
2022-08-21 15:15:35 +02:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 12:06:55 +02:00
char
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
2022-10-26 13:25:41 +02:00
clk
clk: bcm2835: Make peripheral PLLC critical
2022-10-26 13:25:54 +02:00
clocksource
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
2022-07-07 17:52:23 +02:00
connector
…
counter
counter: microchip-tcb-capture: Handle Signal1 read and Synapse
2022-11-03 23:57:50 +09:00
cpufreq
cpufreq: qcom: fix memory leak in error path
2022-10-30 09:41:15 +01:00
cpuidle
cpuidle: Fix kobject memory leaks in error paths
2021-11-18 14:04:05 +01:00
crypto
crypto: cavium - prevent integer overflow loading firmware
2022-10-26 13:25:43 +02:00
dax
devdax: Fix soft-reservation memory description
2022-09-28 11:10:41 +02:00
dca
…
devfreq
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
2022-07-07 17:52:18 +02:00
dio
…
dma
dmaengine: at_hdmac: Check return code of dma_async_device_register
2022-11-16 09:57:20 +01:00
dma-buf
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
2022-10-26 13:25:48 +02:00
edac
EDAC/ghes: Set the DIMM label unconditionally
2022-08-03 12:00:50 +02:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 18:32:43 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:25:32 +02:00
firmware
efi: random: Use 'ACPI reclaim' memory for random seed
2022-11-10 18:14:27 +01:00
fpga
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
2022-10-26 13:25:33 +02:00
fsi
fsi: core: Check error number after calling ida_simple_get
2022-10-26 13:25:38 +02:00
gnss
…
gpio
gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
2022-09-28 11:10:27 +02:00
gpu
drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
2022-11-25 17:45:44 +01:00
greybus
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-08 14:39:50 +02:00
hid
HID: hyperv: fix possible memory leak in mousevsc_probe()
2022-11-16 09:57:08 +01:00
hsi
HSI: omap_ssi_port: Fix dma_map_sg error check
2022-10-26 13:25:32 +02:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 11:10:39 +02:00
hwmon
hwmon/coretemp: Handle large core ID value
2022-10-30 09:41:15 +01:00
hwspinlock
hwspinlock: qcom: correct MMIO max register for newer SoCs
2022-11-16 09:57:07 +01:00
hwtracing
coresight: cti: Fix hang in cti_disable_hw()
2022-11-10 18:14:25 +01:00
i2c
i2c: i801: add lis3lv02d's I2C address for Vostro 5568
2022-11-25 17:45:40 +01:00
i3c
Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
2021-05-14 09:50:05 +02:00
ide
…
idle
intel_idle: Disable IBRS during long idle
2022-07-25 11:26:43 +02:00
iio
iio: pressure: ms5611: changed hardcoded SPI speed to value limited
2022-11-25 17:45:52 +01:00
infiniband
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
2022-11-10 18:14:17 +01:00
input
Input: iforce - invert valid length check when fetching device IDs
2022-11-25 17:45:52 +01:00
interconnect
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
2022-09-28 11:10:28 +02:00
iommu
iommu/vt-d: Clean up si_domain in the init_dmars() error path
2022-10-30 09:41:18 +01:00
ipack
ipack: ipoctal: fix module reference leak
2021-10-06 15:56:01 +02:00
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:38:12 +02:00
isdn
mISDN: fix misuse of put_device() in mISDN_register_device()
2022-11-25 17:45:46 +01:00
leds
leds: lm3601x: Don't use mutex after it was destroyed
2022-10-26 13:25:18 +02:00
lightnvm
lightnvm: disable the subsystem
2022-05-09 09:04:56 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 13:06:47 +02:00
mailbox
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
2022-10-26 13:25:40 +02:00
mcb
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:11:00 +02:00
md
dm ioctl: fix misbehavior if list_versions races with module loading
2022-11-25 17:45:52 +01:00
media
media: dvb-frontends/drxk: initialize err to 0
2022-11-10 18:14:22 +01:00
memory
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
2022-10-26 13:25:28 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-21 15:15:58 +02:00
message
…
mfd
mtd: spi-nor: intel-spi: Disable write protection only if asked
2022-11-25 17:45:41 +01:00
misc
misc: ocxl: fix possible refcount leak in afu_ioctl()
2022-10-26 13:25:33 +02:00
mmc
mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA
2022-11-25 17:45:41 +01:00
most
most: fix control-message timeouts
2021-11-18 14:03:51 +01:00
mtd
spi: intel: Use correct mask for flash and protected regions
2022-11-25 17:45:41 +01:00
mux
…
net
net: thunderbolt: Fix error handling in tbnet_init()
2022-11-25 17:45:48 +01:00
nfc
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
2022-11-10 18:14:17 +01:00
ntb
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:38:01 +02:00
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:52:15 +02:00
nvme
nvme-hwmon: kmalloc the NVME SMART log buffer
2022-10-30 09:41:17 +01:00
nvmem
nvmem: core: set size for sysfs bin file
2022-01-27 10:54:22 +01:00
of
of: fdt: fix off-by-one error in unflatten_dt_nodes()
2022-09-23 14:16:57 +02:00
opp
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-21 15:16:04 +02:00
oprofile
…
parisc
parisc: Export iosapic_serial_irq() symbol for serial port driver
2022-11-10 18:14:27 +01:00
parport
parport_pc: Avoid FIFO port location truncation
2022-11-25 17:45:44 +01:00
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 13:25:11 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 18:32:30 +02:00
perf
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
2022-09-20 12:38:32 +02:00
phy
phy: stm32: fix an error code in probe
2022-11-16 09:57:08 +01:00
pinctrl
pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
2022-11-25 17:45:44 +01:00
platform
platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized
2022-11-25 17:45:47 +01:00
pnp
…
power
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
2022-10-26 13:25:52 +02:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:25:44 +02:00
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-13 21:00:55 +02:00
pwm
pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource()
2022-08-21 15:15:37 +02:00
rapidio
rapidio: handle create_workqueue() failure
2021-05-26 12:06:52 +02:00
ras
…
regulator
regulator: core: Prevent integer underflow
2022-10-26 13:25:46 +02:00
remoteproc
remoteproc: sysmon: Wait for SSCTL service to come up
2022-08-21 15:16:08 +02:00
reset
reset: imx7: Fix the iMX8MP PCIe PHY PERST support
2022-10-05 10:38:40 +02:00
rpmsg
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-15 07:55:54 +02:00
rtc
rtc: mt6397: check return value after calling platform_get_resource()
2022-06-14 18:32:33 +02:00
s390
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
2022-09-28 11:10:38 +02:00
sbus
…
scsi
scsi: core: Restrict legal sdev_state transitions via sysfs
2022-11-10 18:14:22 +01:00
sfi
…
sh
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:39:12 +01:00
siox
siox: fix possible memory leak in siox_device_add()
2022-11-25 17:45:44 +01:00
slimbus
slimbus: stream: correct presence rate frequencies
2022-11-25 17:45:50 +01:00
soc
soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
2022-10-26 13:25:29 +02:00
soundwire
soundwire: intel: fix error handling on dai registration issues
2022-10-26 13:25:53 +02:00
spi
spi: stm32: Print summary 'callbacks suppressed' message
2022-11-25 17:45:42 +01:00
spmi
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 13:25:39 +02:00
ssb
ssb: Fix error return code in ssb_bus_scan()
2021-07-14 16:56:21 +02:00
staging
media: meson: vdec: fix possible refcount leak in vdec_probe()
2022-11-10 18:14:22 +01:00
target
target: remove an incorrect unmap zeroes data deduction
2022-06-09 10:21:01 +02:00
tc
…
tee
tee: fix compiler warning in tee_shm_register()
2022-09-15 11:32:04 +02:00
thermal
thermal: intel_powerclamp: Use first online CPU as control_cpu
2022-10-26 13:25:56 +02:00
thunderbolt
thunderbolt: Explicitly enable lane adapter hotplug events at startup
2022-10-26 13:25:16 +02:00
tty
serial: 8250_lpss: Configure DMA also w/o DMA filter
2022-11-25 17:45:52 +01:00
uio
uio_hv_generic: Fix a memory leak in error handling paths
2021-05-26 12:06:52 +02:00
usb
usb: typec: mux: Enter safe mode only when pins need to be reconfigured
2022-11-25 17:45:51 +01:00
vdpa
vdpasim: allow to enable a vq repeatedly
2022-06-09 10:21:29 +02:00
vfio
vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
2022-09-28 11:10:38 +02:00
vhost
vhost/vsock: Use kvmalloc/kvfree for larger packets.
2022-10-26 13:25:22 +02:00
video
fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
2022-11-10 18:14:21 +01:00
virt
vboxguest: Do not use devm for irq
2022-08-25 11:38:14 +02:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 21:20:13 +02:00
visorbus
visorbus: fix error return code in visorchipset_init()
2021-07-14 16:56:41 +02:00
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-13 21:01:01 +02:00
watchdog
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-21 15:16:10 +02:00
xen
xen/pcpu: fix possible memory leak in register_pcpu()
2022-11-25 17:45:47 +01:00
zorro
…
Kconfig
…
Makefile
…