Emmanuel GrumbachandGreg Kroah-Hartman 870171899d wifi: iwlwifi: fix a memory corruption ...

commit cf4a0d840e upstream.

iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that
if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in
bytes, we'll write past the buffer.

Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218233
Fixes: cf29c5b66b ("iwlwifi: dbg_ini: implement time point handling")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240111150610.2d2b8b870194.I14ed76505a5cf87304e0c9cc05cc0ae85ed3bf91@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-01-31 16:19:06 -08:00

..

accel

accel/habanalabs: fix information leak in sec_attest_info()

2024-01-25 15:35:38 -08:00

accessibility

…

acpi

acpi: property: Let args be NULL in __acpi_node_get_property_reference

2024-01-25 15:35:51 -08:00

amba

…

android

binder: fix race between mmput() and do_exit()

2024-01-25 15:35:42 -08:00

ata

…

atm

…

auxdisplay

…

base

rtc: Extend timeout for waiting for UIP to clear to 1s

2024-01-31 16:18:56 -08:00

bcma

…

block

rbd: don't move requests to the running list on errors

2024-01-31 16:19:06 -08:00

bluetooth

Bluetooth: btmtkuart: fix recv_buf() return value

2024-01-25 15:35:29 -08:00

bus

bus: mhi: host: Add spinlock to protect WP access when queueing TREs

2024-01-31 16:18:52 -08:00

cache

…

cdrom

…

cdx

…

char

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

2024-01-31 16:18:50 -08:00

clk

clk: qcom: dispcc-sm8550: Update disp PLL settings

2024-01-25 15:35:38 -08:00

clocksource

clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings

2024-01-25 15:35:42 -08:00

comedi

…

connector

connector: Fix proc_event_num_listeners count not cleared

2024-01-20 11:51:47 +01:00

counter

…

cpufreq

cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()

2024-01-25 15:35:14 -08:00

cpuidle

cpuidle: haltpoll: Do not enable interrupts when entering idle

2024-01-25 15:35:15 -08:00

crypto

crypto: sahara - do not resize req->src when doing hash operations

2024-01-25 15:35:18 -08:00

cxl

cxl/port: Fix missing target list lock

2024-01-25 15:35:55 -08:00

dax

…

dca

…

devfreq

PM / devfreq: Fix buffer overflow in trans_stat_show

2024-01-31 16:18:50 -08:00

dio

…

dma

dmaengine: idxd: Move dma_free_coherent() out of spinlocked context

2024-01-31 16:18:47 -08:00

dma-buf

…

edac

EDAC/thunderx: Fix possible out-of-bounds string access

2024-01-25 15:35:12 -08:00

eisa

…

extcon

…

firewire

firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards

2024-01-10 17:17:00 +01:00

firmware

firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()

2024-01-25 15:35:20 -08:00

fpga

…

fsi

…

gnss

…

gpio

gpio: mlxbf3: add an error code check in mlxbf3_gpio_probe

2024-01-25 15:35:58 -08:00

gpu

Revert "drm/amd: Enable PCIe PME from D3"

2024-01-31 16:19:00 -08:00

greybus

…

hid

HID: wacom: Correct behavior when processing some confidence == false touches

2024-01-25 15:35:48 -08:00

hsi

…

hte

…

hv

…

hwmon

hwmon: (corsair-psu) Fix probe when built-in

2024-01-20 11:51:42 +01:00

hwspinlock

…

hwtracing

coresight: etm4x: Fix width of CCITMIN field

2024-01-20 11:51:49 +01:00

i2c

i2c: s3c24xx: fix transferring more than one message in polling mode

2024-01-25 15:36:01 -08:00

i3c

…

idle

x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram

2024-01-25 15:35:12 -08:00

iio

iio: adc: ad7091r: Enable internal vref if external vref is not supplied

2024-01-31 16:18:47 -08:00

infiniband

IB/iser: Prevent invalidating wrong MR

2024-01-25 15:35:40 -08:00

input

Input: atkbd - use ab83 as id when skipping the getid command

2024-01-25 15:35:41 -08:00

interconnect

interconnect: qcom: sm8250: Enable sync_state

2024-01-01 12:42:36 +00:00

iommu

iommu: Don't reserve 0-length IOVA region

2024-01-25 15:35:54 -08:00

ipack

…

irqchip

…

isdn

…

leds

leds: aw200xx: Fix write to DIM parameter

2024-01-25 15:35:49 -08:00

macintosh

…

mailbox

…

mcb

…

md

Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""

2024-01-25 15:36:01 -08:00

media

media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

2024-01-31 16:18:55 -08:00

memory

…

memstick

…

message

…

mfd

mfd: intel-lpss: Fix the fractional clock divider flags

2024-01-25 15:35:49 -08:00

misc

…

mmc

mmc: mmc_spi: remove custom DMA mapped buffers

2024-01-31 16:18:55 -08:00

most

…

mtd

mtd: rawnand: Clarify conditions to enable continuous reads

2024-01-31 16:18:50 -08:00

mux

…

net

wifi: iwlwifi: fix a memory corruption

2024-01-31 16:19:06 -08:00

nfc

nfc: virtual_ncidev: Add variable to check if ndev is running

2023-12-20 17:01:59 +01:00

ntb

…

nubus

…

nvdimm

…

nvme

nvmet-tcp: Fix the H2C expected PDU len calculation

2024-01-25 15:35:55 -08:00

nvmem

nvmem: brcm_nvram: store a copy of NVRAM content

2024-01-01 12:42:44 +00:00

of

of: unittest: Fix of_count_phandle_with_args() expected value message

2024-01-25 15:35:40 -08:00

opp

OPP: Pass rounded rate to _set_opp()

2024-01-31 16:18:49 -08:00

parisc

parisc/power: Fix power soft-off button emulation on qemu

2024-01-31 16:18:52 -08:00

parport

parport: parport_serial: Add Brainboxes device IDs and geometry

2024-01-20 11:51:48 +01:00

pci

PCI: mediatek-gen3: Fix translation window size calculation

2024-01-25 15:35:55 -08:00

pcmcia

…

peci

…

perf

drivers/perf: hisi: Fix some event id for HiSilicon UC pmu

2024-01-25 15:35:13 -08:00

phy

phy: sunplus: return negative error code in sp_usb_phy_probe

2024-01-10 17:16:57 +01:00

pinctrl

pinctrl: cy8c95x0: Fix get_pincfg

2024-01-20 11:51:46 +01:00

platform

platform/x86/intel/vsec: Fix xa_alloc memory leak

2024-01-25 15:35:14 -08:00

pmdomain

…

pnp

…

power

power: supply: Fix null pointer dereference in smb2_probe

2024-01-25 15:35:54 -08:00

powercap

…

pps

…

ps3

…

ptp

…

pwm

pwm: Fix out-of-bounds access in of_pwm_single_xlate()

2024-01-25 15:35:46 -08:00

rapidio

…

ras

…

regulator

…

remoteproc

…

reset

reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning

2024-01-20 11:51:44 +01:00

rpmsg

rpmsg: virtio: Free driver_override when rpmsg_remove()

2024-01-31 16:18:50 -08:00

rtc

rtc: Extend timeout for waiting for UIP to clear to 1s

2024-01-31 16:18:56 -08:00

s390

s390/vfio-ap: do not reset queue removed from host config

2024-01-31 16:18:51 -08:00

sbus

…

scsi

scsi: core: Kick the requeue list after inserting when flushing

2024-01-31 16:18:48 -08:00

sh

…

siox

…

slimbus

…

soc

soc: fsl: cpm1: qmc: Fix rx channel reset

2024-01-31 16:18:51 -08:00

soundwire

soundwire: fix initializing sysfs for same devices on different buses

2024-01-31 16:18:47 -08:00

spi

spi: coldfire-qspi: Remove an erroneous clk_disable_unprepare() from the remove function

2024-01-25 15:35:55 -08:00

spmi

spmi: mtk-pmif: Serialize PMIF status check and command submission

2024-01-25 15:35:53 -08:00

ssb

…

staging

media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls

2024-01-25 15:35:32 -08:00

target

scsi: target: core: add missing file_{start,end}_write()

2024-01-25 15:35:45 -08:00

tc

…

tee

…

thermal

drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment

2024-01-25 15:35:15 -08:00

thunderbolt

thunderbolt: Fix memory leak in margining_port_remove()

2024-01-01 12:42:46 +00:00

tty

serial: Do not hold the port lock when setting rx-during-tx GPIO

2024-01-31 16:18:58 -08:00

ufs

scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()

2024-01-31 16:18:48 -08:00

uio

uio: Fix use-after-free in uio_open

2024-01-20 11:51:48 +01:00

usb

usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer

2024-01-25 15:35:54 -08:00

vdpa

vdpa: Fix an error handling path in eni_vdpa_probe()

2024-01-25 15:35:54 -08:00

vfio

hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume

2024-01-25 15:35:55 -08:00

vhost

virtio/vsock: send credit update during setting SO_RCVLOWAT

2024-01-25 15:35:26 -08:00

video

fbdev: flush deferred IO before closing

2024-01-25 15:35:45 -08:00

virt

…

virtio

virtio_ring: fix syncs DMA memory with different direction

2024-01-05 15:19:41 +01:00

vlynq

…

w1

…

watchdog

watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused

2024-01-25 15:35:37 -08:00

xen

…

zorro

…

Kconfig

…

Makefile

…