F.A.Sulaiman b3a4b710b0 HID: betop: fix slab-out-of-bounds Write in betop_probe ...

commit 1e4ce418b1 upstream.

Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver.
The problem is the driver assumes the device must have an input report but
some malicious devices violate this assumption.

So this patch checks hid_device's input is non empty before it's been used.

Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com
Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk>
Reviewed-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-16 11:54:10 +09:00

..

accessibility

…

acpi

ACPI: NFIT: Fix support for virtual SPA ranges

2023-05-16 11:41:51 +09:00

amba

amba: Fix resource leak for drivers without .remove

2023-05-16 10:37:49 +09:00

amlogic

tee: disable by default

2023-05-12 16:27:16 +09:00

android

UPSTREAM: binder: fix incorrect cmd to binder_stat_br

2023-05-16 09:46:39 +09:00

ata

ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()

2023-05-16 11:46:00 +09:00

atm

atm: nicstar: register the interrupt handler in the right place

2023-05-16 11:25:37 +09:00

auxdisplay

…

base

PM / wakeirq: Fix unbalanced IRQ enable for wakeirq

2023-05-16 11:52:24 +09:00

bcma

bcma: Fix memory leak for internally-handled cores

2023-05-16 11:44:50 +09:00

block

cryptoloop: add a deprecation warning

2023-05-16 11:43:11 +09:00

bluetooth

Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.

2023-05-16 11:25:48 +09:00

bus

bus: qcom: Put child node before return

2023-05-16 11:02:09 +09:00

cdrom

cdrom: gdrom: initialize global variable at init time

2023-05-16 11:05:40 +09:00

char

virtio_console: Assure used length from device is limited

2023-05-16 11:27:25 +09:00

clk

clk: kirkwood: Fix a clocking boot regression

2023-05-16 11:44:57 +09:00

clocksource

clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined

2023-05-16 10:37:41 +09:00

connector

…

cpufreq

cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory

2023-05-16 11:53:41 +09:00

cpuidle

cpuidle: Fix three reference count leaks

2023-05-15 17:34:06 +09:00

crypto

crypto: talitos - fix max key size for sha384 and sha512

2023-05-16 11:52:26 +09:00

dax

device-dax: implement ->split() to catch invalid munmap attempts

2018-02-28 10:18:33 +01:00

dca

…

devfreq

PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out

2023-05-16 09:14:54 +09:00

dio

…

dma

dmaengine: xilinx_dma: Set DMA mask for coherent APIs

2023-05-16 11:52:41 +09:00

dma-buf

dma-buf: Fix memory leak in sync_file_merge()

2023-05-15 16:17:55 +09:00

edac

EDAC/synopsys: Fix wrong value type assignment for edac_mode

2023-05-16 11:54:02 +09:00

eisa

…

extcon

extcon: max8997: Add missing modalias string

2023-05-16 11:24:53 +09:00

firewire

firewire: nosy: Fix a use-after-free bug in nosy_ioctl()

2023-05-16 10:50:08 +09:00

firmware

qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute

2023-05-16 11:26:05 +09:00

fmc

…

fpga

…

gpio

gpio: zynq: Check return value of pm_runtime_get_sync

2023-05-16 11:26:47 +09:00

gpu

drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV

2023-05-16 11:52:51 +09:00

hardkernel

ODROID-G12: Make hid-multitouch and dwav-usb-mt driver as mouldes.

2022-03-15 09:20:56 +09:00

hid

HID: betop: fix slab-out-of-bounds Write in betop_probe

2023-05-16 11:54:10 +09:00

hsi

HSI: core: fix resource leaks in hsi_add_client_from_dt()

2023-05-16 11:02:44 +09:00

hv

Drivers: hv: vmbus: Increase wait time for VMbus unload

2023-05-16 11:02:24 +09:00

hwmon

hwmon: (tmp421) fix rounding for negative values

2023-05-16 11:53:47 +09:00

hwspinlock

…

hwtracing

intel_th: Consistency and off-by-one fix

2023-05-16 10:53:58 +09:00

i2c

i2c: mt65xx: fix IRQ check

2023-05-16 11:44:46 +09:00

ide

block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>

2023-05-16 09:04:57 +09:00

idle

x86/cpu: Sanitize FAM6_ATOM naming

2023-05-15 12:46:28 +09:00

iio

iio: dac: ad5624r: Fix incorrect handling of an optional regulator.

2023-05-16 11:45:28 +09:00

infiniband

IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()

2023-05-16 11:42:47 +09:00

input

Input: hil_kbd - fix error return code in hil_dev_connect()

2023-05-16 11:24:37 +09:00

iommu

iommu/amd: Fix backport of 140456f994

2023-05-16 11:34:38 +09:00

ipack

ipack: ipoctal: fix module reference leak

2023-05-16 11:53:57 +09:00

irqchip

irqchip/alpine-msi: Fix freeing of interrupts on allocation error path

2023-05-16 09:58:09 +09:00

isdn

mISDN: fix possible use-after-free in HFC_cleanup()

2023-05-16 11:25:08 +09:00

leds

leds: ktd2692: Fix an error handling path

2023-05-16 11:24:56 +09:00

lguest

…

lightnvm

…

macintosh

drivers/macintosh: Fix memleak in windfarm_pm112 driver

2023-05-15 17:34:39 +09:00

mailbox

mailbox: handle failed named mailbox channel request

2023-05-15 14:08:07 +09:00

mcb

mcb: fix error handling in mcb_alloc_bus()

2023-05-16 11:53:10 +09:00

md

dm btree remove: assign new_root only when removal succeeds

2023-05-16 11:26:12 +09:00

media

media: rc-loopback: return number of emitters rather than error

2023-05-16 11:45:11 +09:00

memory

memory: fsl_ifc: fix leak of private memory on probe failure

2023-05-16 11:27:51 +09:00

memstick

memstick: r592: Fix error return in r592_probe()

2023-05-16 09:57:42 +09:00

message

scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()

2023-05-16 09:45:15 +09:00

mfd

mfd: Don't use irq_create_mapping() to resolve a mapping

2023-05-16 11:46:58 +09:00

misc

VMCI: fix NULL pointer dereference when unmapping queue pair

2023-05-16 11:45:08 +09:00

mmc

mmc: rtsx_pci: Fix long reads when clock is prescaled

2023-05-16 11:46:15 +09:00

mtd

mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'

2023-05-16 11:47:04 +09:00

net

e100: fix buffer overrun in e100_get_regs

2023-05-16 11:53:50 +09:00

nfc

nfc: nfcsim: fix use after free during module unload

2023-05-16 11:35:07 +09:00

ntb

NTB: hw: amd: fix an issue about leak system resources

2023-05-16 09:39:21 +09:00

nubus

…

nvdimm

libnvdimm/dimm: Avoid race between probe and available_slots_show()

2023-05-16 10:38:48 +09:00

nvme

nvme-pci: Fix an error handling path in 'nvme_probe()'

2023-05-16 11:43:31 +09:00

nvmem

nvmem: qfprom: remove incorrect write support

2023-05-15 17:31:34 +09:00

of

of: Fix truncation of memory sizes on 32-bit platforms

2023-05-16 11:24:47 +09:00

oprofile

…

parisc

parisc: Move pci_dev_is_behind_card_dino to where it is used

2023-05-16 11:52:39 +09:00

parport

parport: remove non-zero check on count

2023-05-16 11:46:21 +09:00

pci

PCI: Use pci_update_current_state() in pci_enable_device_flags()

2023-05-16 11:45:26 +09:00

pcmcia

pcmcia: i82092: fix a null pointer dereference bug

2023-05-16 11:36:00 +09:00

perf

drivers/perf: arm_pmu: Fix failure path in PM notifier

2023-05-15 14:09:37 +09:00

phy

phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()

2023-05-16 11:24:50 +09:00

pinctrl

pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()

2023-05-16 11:45:22 +09:00

platform

platform/chrome: cros_ec_proto: Send command again when timeout occurs

2023-05-16 11:46:34 +09:00

pnp

…

power

power: supply: max17042: handle fails of reading status register

2023-05-16 11:45:07 +09:00

powercap

powercap: restrict energy meter to root access

2023-05-16 09:46:33 +09:00

pps

drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl

2023-05-15 14:08:51 +09:00

ps3

powerpc/ps3: use dma_mapping_error()

2023-05-16 09:58:13 +09:00

ptp

ptp: free ptp device pin descriptors properly

2023-05-15 17:27:25 +09:00

pwm

pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered

2023-05-16 11:52:37 +09:00

rapidio

rapidio: handle create_workqueue() failure

2023-05-16 11:05:25 +09:00

ras

…

regulator

regulator: da9052: Ensure enough delay time for .set_voltage_time_sel

2023-05-16 11:23:19 +09:00

remoteproc

remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load

2023-05-16 10:35:30 +09:00

reset

reset: ti-syscon: fix to_ti_syscon_reset_data macro

2023-05-16 11:33:29 +09:00

rpmsg

rpmsg: smd: fix memory leak on channel create

2023-05-15 09:23:11 +09:00

rtc

rtc: tps65910: Correct driver module alias

2023-05-16 11:45:00 +09:00

s390

s390/sclp_vt220: fix console name to match device

2023-05-16 11:26:42 +09:00

sbus

drivers/sbus/char: add of_node_put()

2023-05-15 10:37:00 +09:00

scsi

scsi: iscsi: Adjust iface sysfs attr detection

2023-05-16 11:53:15 +09:00

sfi

…

sh

…

sn

…

soc

soc: qcom: smsm: Fix missed interrupts if state changes while masked

2023-05-16 11:44:21 +09:00

spi

spi: Fix tegra20 build with CONFIG_PM=n

2023-05-16 11:53:33 +09:00

spmi

…

ssb

ssb: sdio: Don't overwrite const buffer if block_write fails

2023-05-16 11:22:54 +09:00

staging

staging: greybus: uart: fix tty use after free

2023-05-16 11:53:04 +09:00

target

scsi: target: Fix protect handling in WRITE SAME(32)

2023-05-16 11:34:08 +09:00

tc

TC: Set DMA masks for devices

2023-05-15 09:23:01 +09:00

tee

UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference

2023-05-16 09:46:44 +09:00

thermal

thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()

2023-05-16 11:52:31 +09:00

thunderbolt

thunderbolt: Use 32-bit writes when writing ring producer/consumer

2023-05-15 14:55:28 +09:00

tty

tty: Fix out-of-bound vmalloc access in imageblit

2023-05-16 11:53:38 +09:00

uio

uio_pdrv_genirq: fix use without device tree and no interrupt

2023-05-16 08:31:00 +09:00

usb

USB: serial: option: add device id for Foxconn T99W265

2023-05-16 11:53:09 +09:00

uwb

uwb: hwa-rc: fix memory leak at probe

2023-05-15 08:28:33 +09:00

vfio

vfio: Use config not menuconfig for VFIO_NOIOMMU

2023-05-16 11:45:19 +09:00

vhost

vringh: Use wiov->used to check for read/write desc order

2023-05-16 11:42:53 +09:00

video

video: fbdev: riva: Error out if 'pixclock' equals zero

2023-05-16 11:45:48 +09:00

virt

drivers/virt/fsl_hypervisor: Fix error handling path

2023-05-16 09:38:07 +09:00

virtio

virtio: Improve vq->broken access to avoid any compiler optimization

2023-05-16 11:42:52 +09:00

vlynq

…

vme

vme: bridges: reduce stack usage

2023-05-15 16:59:11 +09:00

w1

w1: mxc_w1: Fix timeout resolution problem leading to bus error

2023-05-16 09:45:14 +09:00

watchdog

watchdog: aspeed: fix hardware timeout calculation

2023-05-16 11:27:31 +09:00

xen

xen/events: Fix race in set_evtchn_to_irq

2023-05-16 11:41:58 +09:00

zorro

zorro: Set up z->dev.dma_mask for the DMA API

2018-05-30 07:50:44 +02:00

Kconfig

ODROID: sysfs: Add poweroff_trigger sysfs node.

2019-12-11 18:21:09 +09:00

Makefile

ODROID: sysfs: Add poweroff_trigger sysfs node.

2019-12-11 18:21:09 +09:00