averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-25 16:19:48 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
e757ff4bbc893bc030c2d10143091094da73b9ff
linux-stable-mirror/drivers
T
History
Chengfeng YeandGreg Kroah-Hartman e757ff4bbc firewire: fix potential uaf in outbound_phy_packet_callback() 
commit b7c81f8024 upstream.

&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.

Cc: <stable@vger.kernel.org>
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12 12:25:31 +02:00
..
accessibility
…
acpi
ACPI: processor idle: Check for architectural support for LPI
2022-04-20 09:23:09 +02:00
amba
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
android
…
ata
ata: pata_marvell: Check the 'bmdma_addr' beforing reading
2022-04-27 13:53:54 +02:00
atm
atm: eni: Add check for dma_map_single
2022-03-23 09:13:27 +01:00
auxdisplay
…
base
arch_topology: Do not set llc_sibling if llc_id is invalid
2022-05-09 09:04:59 +02:00
bcma
…
block
floppy: disable FDRAWCMD by default
2022-05-09 09:04:56 +02:00
bluetooth
Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
2022-04-08 14:40:22 +02:00
bus
bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
2022-05-09 09:05:04 +02:00
cdrom
…
char
virtio_console: eliminate anonymous module_init & module_exit
2022-04-13 21:01:02 +02:00
clk
clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
2022-05-09 09:05:04 +02:00
clocksource
clocksource: acpi_pm: fix return value of __setup handler
2022-04-08 14:40:03 +02:00
connector
…
counter
…
cpufreq
cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
2022-05-09 09:05:03 +02:00
cpuidle
…
crypto
crypto: ccree - Fix use after free in cc_cipher_exit()
2022-04-08 14:40:02 +02:00
dax
dax: make sure inodes are flushed before destroy cache
2022-04-08 14:40:16 +02:00
dca
…
devfreq
…
dio
…
dma
dma: at_xdmac: fix a missing check on list iterator
2022-04-27 13:53:55 +02:00
dma-buf
udmabuf: validate ubuf->pagecount
2022-04-08 14:40:12 +02:00
edac
EDAC/synopsys: Read the error count from the correct register
2022-04-27 13:53:54 +02:00
eisa
…
extcon
…
firewire
firewire: fix potential uaf in outbound_phy_packet_callback()
2022-05-12 12:25:31 +02:00
firmware
firmware: arm_scmi: Fix sorting of retrieved clock rates
2022-04-20 09:23:10 +02:00
fpga
…
fsi
fsi: Aspeed: Fix a potential double free
2022-04-08 14:40:23 +02:00
gnss
…
gpio
gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
2022-05-12 12:25:30 +02:00
gpu
drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT
2022-05-12 12:25:31 +02:00
greybus
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-08 14:39:50 +02:00
hid
HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
2022-04-08 14:40:15 +02:00
hsi
…
hv
Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
2022-04-20 09:23:20 +02:00
hwmon
hwmon: (pmbus) Add Vin unit off handling
2022-04-08 14:40:02 +02:00
hwspinlock
…
hwtracing
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
i2c
i2c: pasemi: Wait for write xfers to finish
2022-04-20 09:23:30 +02:00
i3c
…
ide
…
idle
…
iio
iio:imu:bmi160: disable regulator in error path
2022-05-09 09:05:00 +02:00
infiniband
scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
2022-04-20 09:23:16 +02:00
input
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
interconnect
…
iommu
iommu/vt-d: Calculate mask for non-aligned flushes
2022-05-12 12:25:30 +02:00
ipack
…
irqchip
irqchip/gic, gic-v3: Prevent GSI to SGI translations
2022-04-13 21:01:11 +02:00
isdn
isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
2022-03-16 14:15:57 +01:00
leds
…
lightnvm
lightnvm: disable the subsystem
2022-05-09 09:04:56 +02:00
macintosh
…
mailbox
mailbox: imx: fix wakeup failure from freeze mode
2022-04-08 14:40:41 +02:00
mcb
…
md
dm: fix mempool NULL pointer race when completing IO
2022-04-27 13:53:47 +02:00
media
media: rockchip/rga: do proper error checking in probe
2022-04-20 09:23:10 +02:00
memory
memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode
2022-05-09 09:05:02 +02:00
memstick
…
message
…
mfd
mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
2022-04-08 14:40:23 +02:00
misc
kgdbts: fix return value of __setup handler
2022-04-08 14:40:28 +02:00
mmc
mmc: core: Set HS clock speed before sending HS CMD13
2022-05-12 12:25:30 +02:00
most
…
mtd
mtd: rawnand: Fix return value check of wait_for_completion_timeout
2022-05-09 09:05:02 +02:00
mux
…
net
net: ethernet: stmmac: fix write to sgmii_adapter_base
2022-05-09 09:05:07 +02:00
nfc
nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
2022-03-28 09:57:07 +02:00
ntb
…
nubus
…
nvdimm
nvdimm/region: Fix default alignment for small regions
2022-04-08 14:40:26 +02:00
nvme
nvme-pci: disable namespace identifiers for Qemu controllers
2022-04-27 13:53:54 +02:00
nvmem
…
of
…
opp
…
oprofile
…
parisc
parisc: Fix CPU affinity for Lasi, WAX and Dino chips
2022-04-13 21:01:03 +02:00
parport
…
pci
PCI: endpoint: Fix misused goto label
2022-04-13 21:00:59 +02:00
pcmcia
…
perf
arm_pmu: Validate single/group leader events
2022-04-27 13:53:55 +02:00
phy
phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
2022-05-09 09:05:01 +02:00
pinctrl
pinctrl: pistachio: fix use of irq_of_parse_and_map()
2022-05-09 09:05:03 +02:00
platform
platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
2022-04-27 13:53:53 +02:00
pnp
…
power
power: supply: axp288-charger: Set Vhold to 4.4V
2022-04-13 21:00:57 +02:00
powercap
…
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-13 21:00:55 +02:00
pwm
pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
2022-04-08 14:40:23 +02:00
rapidio
…
ras
…
regulator
regulator: wm8994: Add an off-on delay for WM8994 variant
2022-04-20 09:23:22 +02:00
remoteproc
remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
2022-04-08 14:40:26 +02:00
reset
reset: tegra-bpmp: Restore Handle errors in BPMP response
2022-04-27 13:53:52 +02:00
rpmsg
…
rtc
rtc: wm8350: Handle error for wm8350_register_irq
2022-04-13 21:00:54 +02:00
s390
…
sbus
…
scsi
scsi: qedi: Fix failed disconnect handling
2022-04-27 13:53:54 +02:00
sfi
…
sh
…
siox
…
slimbus
…
soc
soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
2022-04-08 14:40:07 +02:00
soundwire
soundwire: intel: fix wrong register name in intel_shim_wake
2022-04-08 14:40:24 +02:00
spi
spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller
2022-04-27 13:53:57 +02:00
spmi
…
ssb
…
staging
staging: ion: Prevent incorrect reference counting behavour
2022-04-27 13:53:57 +02:00
target
scsi: target: tcmu: Fix possible page UAF
2022-04-20 09:23:21 +02:00
tc
…
tee
…
thermal
thermal: int340x: Fix attr.show callback prototype
2022-05-09 09:05:07 +02:00
thunderbolt
…
tty
tty: n_gsm: fix software flow control handling
2022-05-09 09:05:08 +02:00
uio
…
usb
USB: Fix xhci event ring dequeue pointer ERDP update issue
2022-05-09 09:05:00 +02:00
vdpa
vdpa/mlx5: should verify CTRL_VQ feature exists for MQ
2022-04-08 14:39:47 +02:00
vfio
amba: Make the remove callback return void
2022-04-08 14:40:02 +02:00
vhost
tuntap: add sanity checks about msg_controllen in sendmsg
2022-04-13 21:00:59 +02:00
video
video: fbdev: udlfb: properly check endpoint type
2022-05-09 09:05:00 +02:00
virt
…
virtio
virtio: acknowledge all features before access
2022-03-16 14:16:02 +01:00
visorbus
…
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-13 21:01:01 +02:00
watchdog
watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function
2022-04-08 14:40:41 +02:00
xen
…
zorro
…
Kconfig
…
Makefile
…