TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
119c200b41fc80cb30344befb96db1f68c85c0ab
twx-linux/drivers
T
History
Felix Fietkau 319478cbd2 mt76: fix array overflow on receiving too many fragments for a packet 
commit b102f0c522 upstream.

If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-18 07:14:22 +01:00
..
accessibility
…
acpi
ACPI: watchdog: Fix gas->access_width usage
2020-03-05 16:42:17 +01:00
amba
…
android
…
ata
ata: ahci: Add shutdown to freeze hardware resources of ahci
2020-02-28 16:39:00 +01:00
atm
fore200e: Fix incorrect checks of NULL pointer dereference
2020-02-24 08:34:42 +01:00
auxdisplay
…
base
driver core: platform: fix u32 greater or equal to zero comparison
2020-02-24 08:34:50 +01:00
bcma
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-27 14:51:09 +01:00
block
virtio-blk: fix hw_queue stopped on arbitrary error
2020-03-18 07:14:19 +01:00
bluetooth
…
bus
bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated
2020-01-27 14:50:36 +01:00
cdrom
…
char
ipmi:ssif: Handle a possible NULL pointer reference
2020-03-05 16:42:12 +01:00
clk
clk: uniphier: Add SCSSI clock gate for each channel
2020-02-24 08:34:45 +01:00
clocksource
clocksource/drivers/bcm2835_timer: Fix memory leak of timer
2020-02-24 08:34:37 +01:00
connector
…
cpufreq
cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
2020-01-27 14:50:53 +01:00
cpuidle
…
crypto
crypto: chtls - Fixed memory leak
2020-02-24 08:34:44 +01:00
dax
…
dca
…
devfreq
Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
2020-03-05 16:42:18 +01:00
dio
…
dma
dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
2020-03-11 14:15:12 +01:00
dma-buf
…
edac
EDAC/amd64: Set grain per DIMM
2020-03-11 14:14:45 +01:00
eisa
…
extcon
…
firewire
…
firmware
efi: Make efi_rts_work accessible to efi page fault handler
2020-03-18 07:14:21 +01:00
fmc
…
fpga
…
fsi
fsi: sbefifo: Don't fail operations when in SBE IPL state
2020-01-27 14:51:00 +01:00
gnss
…
gpio
gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_irq_map/unmap()
2020-02-24 08:34:36 +01:00
gpu
drm/amd/display: remove duplicated assignment to grph_obj_type
2020-03-18 07:14:20 +01:00
hid
HID: hiddev: Fix race in in hiddev_disconnect()
2020-03-05 16:42:19 +01:00
hsi
…
hv
hv_balloon: Balloon up according to request page number
2020-02-11 04:34:01 -08:00
hwmon
hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
2020-03-11 14:15:12 +01:00
hwspinlock
…
hwtracing
coresight: tmc-etf: Do not call smp_processor_id from preemptible
2020-01-29 16:43:23 +01:00
i2c
i2c: jz4780: silence log flood on txabrt
2020-03-05 16:42:19 +01:00
ide
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-24 08:34:49 +01:00
idle
…
iio
iio: st_gyro: Correct data for LSM9DS0 gyro
2020-02-01 09:37:04 +00:00
infiniband
IB/hfi1, qib: Ensure RCU is locked when accessing list
2020-03-11 14:15:11 +01:00
input
Input: edt-ft5x06 - work around first register access error
2020-02-24 08:34:46 +01:00
iommu
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
2020-03-18 07:14:19 +01:00
ipack
…
irqchip
irqchip/gic-v3-its: Fix misuse of GENMASK macro
2020-03-05 16:42:12 +01:00
isdn
…
leds
leds: pca963x: Fix open-drain initialization
2020-02-24 08:34:35 +01:00
lightnvm
lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
2020-01-27 14:50:45 +01:00
macintosh
macintosh: windfarm: fix MODINFO regression
2020-03-18 07:14:21 +01:00
mailbox
mailbox: qcom-apcs: fix max_register value
2020-01-27 14:51:14 +01:00
mcb
…
md
dm integrity: fix a deadlock due to offloading to an incorrect workqueue
2020-03-11 14:15:13 +01:00
media
media: v4l2-mem2mem.c: fix broken links
2020-03-11 14:15:03 +01:00
memory
…
memstick
…
message
…
mfd
mfd: rn5t618: Mark ADC control register volatile
2020-02-11 04:34:14 -08:00
misc
mei: me: add comet point (lake) H device ids
2020-02-01 09:37:04 +00:00
mmc
mmc: sdhci-of-at91: fix memleak on clk_get failure
2020-02-11 04:34:00 -08:00
mtd
mtd: sharpslpart: Fix unsigned comparison to zero
2020-02-14 16:33:27 -05:00
mux
…
net
mt76: fix array overflow on receiving too many fragments for a packet
2020-03-18 07:14:22 +01:00
nfc
nfc: pn544: Fix occasional HW initialization failure
2020-03-05 16:42:16 +01:00
ntb
ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev()
2020-01-27 14:50:55 +01:00
nubus
…
nvdimm
…
nvme
nvme: Fix uninitialized-variable warning
2020-03-11 14:14:55 +01:00
nvmem
nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm
2020-01-27 14:50:58 +01:00
of
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
2020-02-11 04:34:03 -08:00
opp
…
oprofile
…
parisc
…
parport
…
pci
PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
2020-02-24 08:34:41 +01:00
pcmcia
…
perf
…
phy
phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
2020-03-11 14:15:10 +01:00
pinctrl
pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
2020-02-24 08:34:44 +01:00
platform
platform/x86: intel_mid_powerbtn: Take a copy of ddata
2020-02-14 16:33:25 -05:00
pnp
…
power
power: supply: ltc2941-battery-gauge: fix use-after-free
2020-02-11 04:34:02 -08:00
powercap
…
pps
…
ps3
…
ptp
…
pwm
pwm: omap-dmtimer: put_device() after of_find_device_by_node()
2020-03-05 16:42:22 +01:00
rapidio
…
ras
…
regulator
regulator: rk808: Lower log level on optional GPIOs being not available
2020-02-24 08:34:40 +01:00
remoteproc
remoteproc: Initialize rproc_class before use
2020-02-24 08:34:50 +01:00
reset
reset: uniphier: Add SCSSI reset control for each channel
2020-02-24 08:34:44 +01:00
rpmsg
…
rtc
rtc: cmos: Stop using shared IRQ
2020-02-14 16:33:24 -05:00
s390
s390/qdio: fill SL with absolute addresses
2020-03-11 14:14:54 +01:00
sbus
…
scsi
scsi: pm80xx: Fixed kernel panic during error recovery for SATA drive
2020-03-11 14:15:13 +01:00
sfi
…
sh
…
siox
…
slimbus
…
sn
…
soc
soc/tegra: fuse: Fix build with Tegra194 configuration
2020-03-05 16:42:13 +01:00
soundwire
…
spi
spi: bcm63xx-hsspi: Really keep pll clk enabled
2020-03-11 14:15:06 +01:00
spmi
…
ssb
…
staging
staging: greybus: use after free in gb_audio_manager_remove_all()
2020-02-28 16:38:59 +01:00
target
scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
2020-02-28 16:38:58 +01:00
tc
…
tee
tee: optee: Fix compilation issue with nommu
2020-02-05 14:43:50 +00:00
thermal
thermal: brcmstb_thermal: Do not use DT coefficients
2020-03-05 16:42:22 +01:00
thunderbolt
thunderbolt: Prevent crash if non-active NVMem file is read
2020-02-28 16:38:44 +01:00
tty
vt: selection, push sel_lock up
2020-03-11 14:15:03 +01:00
uio
uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
2020-02-24 08:34:37 +01:00
usb
usb: core: port: do error out if usb_autopm_get_interface() fails
2020-03-11 14:14:59 +01:00
uwb
…
vfio
vfio/mdev: Fix aborting mdev child device removal if one fails
2020-01-27 14:50:46 +01:00
vhost
vhost: Check docket sk_family instead of call getname
2020-03-05 16:42:18 +01:00
video
vgacon: Fix a UAF in vgacon_invert_region
2020-03-11 14:15:00 +01:00
virt
…
virtio
virtio_balloon: prevent pfn array overflow
2020-02-24 08:34:54 +01:00
visorbus
visorbus: fix uninitialized variable access
2020-02-24 08:34:47 +01:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-24 08:34:47 +01:00
w1
…
watchdog
watchdog: da9062: do not ping the hw during stop()
2020-03-11 14:14:53 +01:00
xen
xen: Enable interrupts when calling _cond_resched()
2020-02-28 16:39:00 +01:00
zorro
…
Kconfig
…
Makefile
…