averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-08 18:13:59 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
c55da494dfb445fb28df3a9d293c2be6a299cd01
linux-stable-mirror/drivers
T
History
Michael Bommarito c55da494df thunderbolt: Limit XDomain response copy to actual frame size 
commit 4db2bd2ed4 upstream.

tb_xdomain_copy() copies req->response_size bytes from the received
packet buffer regardless of the actual frame size.  When a short
response arrives, this reads past the valid frame data in the DMA
pool buffer into stale contents from previous transactions.

Use the minimum of frame size and expected response size for the
copy length.

Fixes: cdae7c07e3 ("thunderbolt: Add support for XDomain properties")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-19 13:21:39 +02:00
..
accessibility
…
acpi
ACPI: video: force native backlight on HP OMEN 16 (8A44)
2026-06-01 17:29:22 +02:00
amba
…
android
…
ata
…
atm
…
auxdisplay
…
base
devres: fix missing node debug info in devm_krealloc()
2026-06-01 17:29:30 +02:00
bcma
…
block
drbd: Balance RCU calls in drbd_adm_dump_devices()
2026-06-01 17:29:30 +02:00
bluetooth
Bluetooth: btusb: Allow firmware re-download when version matches
2026-06-19 13:21:28 +02:00
bus
…
cdrom
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
2026-06-01 17:29:43 +02:00
char
ipmi:ssif: NULL thread on error
2026-06-01 17:29:22 +02:00
clk
clk: qcom: dispcc-sc7180: Add missing MDSS resets
2026-06-01 17:29:38 +02:00
clocksource
…
connector
…
counter
…
cpufreq
…
cpuidle
cpuidle: powerpc: avoid double clear when breaking snooze
2026-06-01 17:29:25 +02:00
crypto
crypto: ccp - copy IV using skcipher ivsize
2026-06-01 17:29:38 +02:00
dax
…
dca
…
devfreq
…
dio
…
dma
dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
2026-06-01 17:29:35 +02:00
dma-buf
…
edac
…
eisa
…
extcon
…
firewire
…
firmware
efi/capsule-loader: fix incorrect sizeof in phys array reallocation
2026-06-01 17:29:34 +02:00
fpga
…
fsi
…
gnss
…
gpio
gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
2026-06-01 17:29:57 +02:00
gpu
drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
2026-06-19 13:21:38 +02:00
greybus
…
hid
HID: core: Fix size_t specifier in hid_report_raw_event()
2026-06-19 13:21:33 +02:00
hsi
…
hv
…
hwmon
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
2026-06-01 17:29:55 +02:00
hwspinlock
…
hwtracing
…
i2c
i2c: tegra: Fix NOIRQ suspend/resume
2026-06-19 13:21:38 +02:00
i3c
i3c: fix uninitialized variable use in i2c setup
2026-06-01 17:29:16 +02:00
ide
…
idle
…
iio
iio: buffer: hw-consumer: fix use-after-free in error path
2026-06-19 13:21:28 +02:00
infiniband
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
2026-06-19 13:21:38 +02:00
input
Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
2026-06-19 13:21:38 +02:00
interconnect
…
iommu
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
2026-06-19 13:21:29 +02:00
ipack
…
irqchip
irqchip/ath79-cpu: Remove unused function
2026-06-01 17:29:56 +02:00
isdn
…
leds
…
lightnvm
…
macintosh
…
mailbox
mailbox: mailbox-test: make data_ready a per-instance variable
2026-06-01 17:29:42 +02:00
mcb
…
md
dm cache policy smq: check allocation under invalidate lock
2026-06-19 13:21:34 +02:00
media
media: dib8000: avoid division by 0 in dib8000_set_dds()
2026-06-01 17:29:28 +02:00
memory
memory: tegra30-emc: Fix dll_change check
2026-06-01 17:29:34 +02:00
memstick
…
message
…
mfd
mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
2026-06-01 17:29:37 +02:00
misc
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
2026-06-19 13:21:38 +02:00
mmc
mmc: sdhci: add signal voltage switch in sdhci_resume_host
2026-06-19 13:21:39 +02:00
most
…
mtd
mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
2026-06-01 17:29:36 +02:00
mux
…
net
net: mv643xx: fix OF node refcount
2026-06-19 13:21:39 +02:00
nfc
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
2026-06-19 13:21:25 +02:00
ntb
…
nubus
…
nvdimm
…
nvme
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
2026-06-01 17:29:26 +02:00
nvmem
…
of
…
opp
…
oprofile
…
parisc
parisc: Fix IRQ leak in LASI driver
2026-06-01 17:29:24 +02:00
parport
parport: Fix race between port and client registration
2026-06-19 13:21:28 +02:00
pci
PCI: tegra194: Disable direct speed change for Endpoint mode
2026-06-01 17:29:34 +02:00
pcmcia
PCMCIA: Fix garbled log messages for KERN_CONT
2026-06-01 17:29:38 +02:00
perf
…
phy
phy: renesas: rcar-gen3-usb2: Fix the use of msleep during spinlock
2026-06-19 13:21:24 +02:00
pinctrl
pinctrl: abx500: Fix type of 'argument' variable
2026-06-01 17:29:36 +02:00
platform
platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
2026-06-01 17:29:57 +02:00
pnp
…
power
power: supply: max17042: avoid overflow when determining health
2026-06-01 17:29:26 +02:00
powercap
…
pps
…
ps3
…
ptp
…
pwm
…
rapidio
…
ras
…
regulator
regulator: act8945a: fix OF node reference imbalance
2026-06-01 17:29:28 +02:00
remoteproc
…
reset
…
rpmsg
…
rtc
rtc: allow rtc_read_alarm without read_alarm callback
2026-06-01 17:29:47 +02:00
s390
Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()"
2026-06-01 17:29:50 +02:00
sbus
…
scsi
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
2026-06-19 13:21:32 +02:00
sfi
…
sh
…
siox
…
slimbus
…
soc
soc: qcom: aoss: compare against normalized cooling state
2026-06-01 17:29:35 +02:00
soundwire
…
spi
spi: meson-spicc: Fix double-put in remove path
2026-06-19 13:21:35 +02:00
spmi
…
ssb
…
staging
HID: pass the buffer size to hid_report_raw_event
2026-06-19 13:21:33 +02:00
target
scsi: target: core: Fix integer overflow in UNMAP bounds check
2026-06-01 17:29:37 +02:00
tc
…
tee
tee: optee: prevent use-after-free when the client exits before the supplicant
2026-06-19 13:21:33 +02:00
thermal
thermal/drivers/spear: Fix error condition for reading st,thermal-flags
2026-06-01 17:29:30 +02:00
thunderbolt
thunderbolt: Limit XDomain response copy to actual frame size
2026-06-19 13:21:39 +02:00
tty
serial: dz: Fix bootconsole handover lockup
2026-06-19 13:21:32 +02:00
uio
…
usb
USB: serial: kl5kusb105: fix bulk-out buffer overflow
2026-06-19 13:21:37 +02:00
vdpa
…
vfio
…
vhost
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
2026-06-01 17:29:41 +02:00
video
fbdev: offb: fix PCI device reference leak on probe failure
2026-06-01 17:29:41 +02:00
virt
…
virtio
…
visorbus
…
vlynq
…
vme
…
w1
…
watchdog
…
xen
…
zorro
…
Kconfig
…
Makefile
…