Kees Cook 304a854922 usb: iowarrior: don't trust report_size for buffer size ...

commit 3ed780117d upstream.

If the iowarrior devices in this case statement support more than 8 bytes
per report, it is possible to write past the end of a kernel heap allocation.
This will probably never be possible, but change the allocation to be more
defensive anyway.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Acked-by: Brandon Philips <bphilips@suse.de>

2011-03-07 15:17:58 -08:00

..

accessibility

…

acpi

ACPI: EC: Add another dmi match entry for MSI hardware

2011-01-07 14:43:07 -08:00

amba

Merge branches 'arm', 'at91', 'bcmring', 'ep93xx', 'mach-types', 'misc' and 'w90x900' into devel

2009-09-12 12:01:34 +01:00

ata

pata_mpc52xx: inherit from ata_bmdma_port_ops

2011-02-17 15:37:10 -08:00

atm

solos-pci: Fix race condition in tasklet RX handling

2010-08-13 13:19:34 -07:00

auxdisplay

…

base

firmware_class: fix memory leak - free allocated pages

2010-08-02 10:21:25 -07:00

block

Fix pktcdvd ioctl dev_minor range check

2011-03-02 09:46:34 -05:00

bluetooth

bluetooth: Fix missing NULL check

2010-11-22 10:47:30 -08:00

cdrom

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24 07:21:04 -07:00

char

tpm_tis: Use timeouts returned from TPM

2011-02-17 15:37:11 -08:00

clocksource

clocksource: sh_tmu: compute mult and shift before registration

2010-09-26 17:21:37 -07:00

connector

connector: Delete buggy notification code.

2010-02-09 04:50:59 -08:00

cpufreq

revert "[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)"

2010-08-02 10:21:25 -07:00

cpuidle

cpuidle: Fix incorrect optimization

2010-05-12 14:57:16 -07:00

crypto

crypto: padlock - Fix AES-CBC handling on odd-block-sized input

2010-12-09 13:27:10 -08:00

dca

dca: module load should not be an error message

2009-09-13 10:27:04 -07:00

dio

…

dma

mv_xor: fix race in tasklet function

2011-01-07 14:43:17 -08:00

edac

amd64_edac: Fix interleaving check

2011-01-07 14:43:06 -08:00

eisa

…

firewire

firewire: ohci: fix race in AR split packet handling

2010-12-09 13:26:50 -08:00

firmware

DMI: allow omitting ident strings in DMI tables

2010-01-28 15:01:52 -08:00

gpio

gpiolib: Actually set output state in wm831x_gpio_direction_output()

2010-03-15 08:49:57 -07:00

gpu

drm: fix unsigned vs signed comparison issue in modeset ctl ioctl.

2011-03-07 15:17:52 -08:00

hid

HID: add support for Acan FG-8100 barcode reader

2011-03-07 15:17:56 -08:00

hwmon

hwmon: (via686a) Initialize fan_div values

2011-02-17 15:36:43 -08:00

i2c

i2c: Unregister dummy devices last on adapter removal

2011-02-17 15:37:03 -08:00

ide

ide-cd: Do not access completed requests in the irq handler

2010-08-13 13:19:36 -07:00

idle

ioat: switch watchdog and reset handler from workqueue to timer

2009-09-08 17:30:24 -07:00

ieee1394

headers: remove sched.h from interrupt.h

2009-10-11 11:20:58 -07:00

ieee802154

ieee802154: dont leak skbs in ieee802154_fake_xmit()

2009-11-19 13:16:21 -08:00

infiniband

IB/uverbs: Handle large number of entries in poll CQ

2011-01-07 14:43:06 -08:00

input

input: bcm5974: Add support for MacBookAir3

2011-02-17 15:36:59 -08:00

isdn

isdn: hisax: Replace the bogus access to irq stats

2011-03-02 09:46:41 -05:00

leds

leds-gpio: fix default state handling on OF platforms

2010-04-01 15:58:53 -07:00

lguest

lguest: fix bug in setting guest GDT entry

2010-01-06 15:05:19 -08:00

macintosh

macintosh/therm_adt746x: Fix sysfs attributes lifetime

2010-03-15 08:49:46 -07:00

mca

…

md

md: correctly handle probe of an 'mdp' device.

2011-03-02 09:47:05 -05:00

media

radio-aimslab.c needs #include <linux/delay.h>

2011-03-02 09:46:52 -05:00

memstick

memstick: fix hangs on unexpected device removal in mspro_blk

2010-08-26 16:41:32 -07:00

message

mptfusion: Fix Incorrect return value in mptscsih_dev_reset

2011-03-02 09:46:33 -05:00

mfd

mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo

2011-03-07 15:17:53 -08:00

misc

x86: uv: xpc NULL deref when mesq becomes empty

2010-12-09 13:27:15 -08:00

mmc

mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_remove

2010-10-28 21:43:55 -07:00

mtd

pxa3xx: fix ns2cycle equation

2010-08-26 16:41:42 -07:00

net

r8169: disable ASPM

2011-03-07 15:17:58 -08:00

nubus

…

of

of: Remove nested function

2009-10-15 09:58:27 -06:00

oprofile

oprofile: fix crash when accessing freed task structs

2010-09-20 13:17:50 -07:00

parisc

PARISC: led.c - fix potential stack overflow in led_proc_write()

2010-08-10 10:20:37 -07:00

parport

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24 07:21:04 -07:00

pci

PCI: pci-stub: ignore zero-length id parameters

2011-02-17 15:37:01 -08:00

pcmcia

pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq

2010-08-26 16:41:53 -07:00

platform

platform: x86: tc1100-wmi: world-writable sysfs wireless and jogdial files

2011-03-02 09:46:55 -05:00

pnp

ACPI: remove acpi_device.flags.hardware_id

2009-09-25 15:09:48 -04:00

power

ds2760_battery: Fix calculation of time_to_empty_now

2011-02-17 15:37:02 -08:00

pps

pps: events reporting fix up

2009-11-12 07:26:01 -08:00

ps3

powerpc/ps3: Workaround for flash memory I/O error

2009-09-11 11:28:00 +10:00

rapidio

…

regulator

regulator: Fix display of null constraints for regulators

2010-02-23 07:37:49 -08:00

rtc

rtc-cmos: fix suspend/resume

2011-02-17 15:37:00 -08:00

s390

nohz: Introduce arch_needs_cpu

2010-08-13 13:20:13 -07:00

sbus

const: make block_device_operations const

2009-09-22 07:17:25 -07:00

scsi

scsi_dh_alua: Add IBM Power Virtual SCSI ALUA device to dev list

2011-03-02 09:46:43 -05:00

serial

serial: unbreak billionton CF card

2011-02-17 15:37:03 -08:00

sfi

SFI: remove __init from sfi_verify_table

2009-10-03 01:16:12 -04:00

sh

sh: Fix up simplified multi-evt handling under sparseirq.

2009-08-31 15:15:33 +09:00

sn

…

spi

SPI: spi_txx9: Fix bit rate calculation

2009-12-02 23:58:32 +00:00

ssb

ssb: b43-pci-bridge: Add new vendor for BCM4318

2010-12-09 13:26:41 -08:00

staging

staging: usbip: vhci: use urb->dev->portnum to find port

2011-03-02 09:47:04 -05:00

tc

…

telephony

…

thermal

acpi: thermal: Add EOL to the trip_point_N_type strings

2009-11-05 17:33:24 -05:00

uio

uio: pm_runtime_disable is needed if failed

2009-11-13 11:36:00 +09:00

usb

usb: iowarrior: don't trust report_size for buffer size

2011-03-07 15:17:58 -08:00

uwb

headers: remove sched.h from interrupt.h

2009-10-11 11:20:58 -07:00

video

efifb: support the EFI framebuffer on more Apple hardware

2010-12-09 13:27:08 -08:00

virtio

virtio: set pci bus master enable bit

2011-03-07 15:17:55 -08:00

vlynq

drivers/vlynq/vlynq.c: fix resource size off by 1 error

2009-09-24 07:21:05 -07:00

w1

w1: w1 temp: fix negative termperature calculation

2010-05-12 14:57:00 -07:00

watchdog

WATCHDOG: iTCO_wdt: TCO Watchdog patch for additional Intel Cougar Point DeviceIDs

2010-04-26 07:41:18 -07:00

xen

xen: ensure that all event channels start off bound to VCPU 0

2010-12-09 13:26:42 -08:00

zorro

…

Kconfig

…

Makefile

virtio: initialize earlier

2010-05-12 14:57:15 -07:00