Zijun Hu f9397cf7bf software node: Correct a OOB check in software_node_get_reference_args() ...

[ Upstream commit 31e4e12e0e9609850cefd4b2e1adf782f56337d6 ]

software_node_get_reference_args() wants to get @index-th element, so
the property value requires at least '(index + 1) * sizeof(*ref)' bytes
but that can not be guaranteed by current OOB check, and may cause OOB
for malformed property.

Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.

Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20250414-fix_swnode-v2-1-9c9e6ae11eab@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-06-27 11:08:56 +01:00

..

firmware_loader

firmware_loader: Fix possible resource leak in fw_log_firmware_info()

2024-12-09 10:32:37 +01:00

power

PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()

2025-06-27 11:08:52 +01:00

regmap

regmap-irq: Add missing kfree()

2025-02-21 13:57:19 +01:00

test

drivers: base: test: Add missing MODULE_* macros to root device tests

2023-08-16 19:01:29 +02:00

arch_numa.c

arm64: irq: set the correct node for VMAP stack

2024-02-05 20:14:14 +00:00

arch_topology.c

arch_topology: Remove early cacheinfo error message if -ENOENT

2023-04-14 10:13:38 +01:00

attribute_container.c

driver core: attribute_container: fix W=1 warnings

2021-05-14 13:37:10 +02:00

auxiliary.c

driver core: make struct bus_type.uevent() take a const *

2023-01-27 13:45:52 +01:00

base.h

driver core: fix potential NULL pointer dereference in dev_uevent()

2025-05-02 07:51:03 +02:00

bus.c

driver core: fix potential NULL pointer dereference in dev_uevent()

2025-05-02 07:51:03 +02:00

cacheinfo.c

cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU

2024-12-14 19:59:55 +01:00

class.c

driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()

2025-02-08 09:52:27 +01:00

component.c

drivers: base: component: fix memory leak with using debugfs_lookup()

2023-02-08 13:33:10 +01:00

container.c

driver core: Remove redundant license text

2017-12-07 18:36:44 +01:00

core.c

driver core: fix potential NULL pointer dereference in dev_uevent()

2025-05-02 07:51:03 +02:00

cpu.c

x86/its: Enable Indirect Target Selection mitigation

2025-05-18 08:24:11 +02:00

dd.c

driver core: introduce device_set_driver() helper

2025-05-02 07:51:03 +02:00

devcoredump.c

devcoredump: Send uevent once devcd is ready

2023-12-13 18:45:33 +01:00

devres.c

drivers: base: devres: Allow to release group on device release

2025-04-25 10:45:18 +02:00

devtmpfs.c

driver core: clean up the logic to determine which /sys/dev/ directory to use

2023-03-31 17:45:07 +02:00

driver.c

driver core: create bus_is_registered()

2023-02-09 10:43:35 +01:00

firmware.c

driver core: Remove redundant license text

2017-12-07 18:36:44 +01:00

hypervisor.c

driver core: Remove redundant license text

2017-12-07 18:36:44 +01:00

init.c

init: Initialize noop_backing_dev_info early

2022-06-16 10:55:57 +02:00

isa.c

isa: Remove unnecessary checks

2023-05-31 19:03:39 +01:00

Kconfig

driver core: Add CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT

2023-03-28 18:45:59 +02:00

Makefile

genirq: Get rid of GENERIC_MSI_IRQ_DOMAIN

2022-11-17 15:15:20 +01:00

map.c

driver: base: Prefer unsigned int to bare use of unsigned

2021-07-21 17:30:09 +02:00

memory.c

mm/memory_hotplug: add missing mem_hotplug_lock

2023-12-13 18:45:24 +01:00

module.c

drivers: base: handle module_kobject creation

2025-05-09 09:44:07 +02:00

node.c

base/node.c: initialize the accessor list before registering

2024-01-25 15:35:51 -08:00

physical_location.c

driver core: location: Free struct acpi_pld_info *pld before return false

2023-01-20 14:20:30 +01:00

physical_location.h

driver core: physical_location.h remove extern from function prototypes

2023-03-24 15:35:48 +01:00

pinctrl.c

driver core: Remove redundant license text

2017-12-07 18:36:44 +01:00

platform-msi.c

genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced

2023-03-02 18:09:44 +01:00

platform.c

of: Move of_platform_register_reconfig_notifier() into DT core

2023-08-04 11:36:33 -06:00

property.c

drivers: fwnode: fix fwnode_irq_get[_byname]()

2023-06-15 13:37:35 +02:00

soc.c

base: soc: populate machine name in soc_device_register if empty

2023-03-29 12:21:23 +02:00

swnode.c

software node: Correct a OOB check in software_node_get_reference_args()

2025-06-27 11:08:56 +01:00

syscore.c

syscore: Use pm_pr_dbg() for syscore_{suspend,resume}()

2020-09-08 13:32:06 +02:00

topology.c

topology: Keep the cpumask unchanged when printing cpumap

2025-01-17 13:36:20 +01:00

trace.c

devres: Enable trace events

2021-06-15 17:14:36 +02:00

trace.h

devres: Enable trace events

2021-06-15 17:14:36 +02:00

transport_class.c

drivers: base: transport_class: fix resource leak when transport_add_device() fails

2023-01-20 14:22:53 +01:00