TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
72e2df70fb52bf7a789914b2de44bc56dc21ca1d
twx-linux/drivers
T
History
Larry Finger e34182fb8a staging: rtl8723bs: Fix potential overuse of kernel memory 
commit 23954cb078 upstream.

In routine wpa_supplicant_ioctl(), the user-controlled p->length is
checked to be at least the size of struct ieee_param size, but the code
does not detect the case where p->length is greater than the size
of the struct, thus a malicious user could be wasting kernel memory.
Fixes commit 554c0a3abf ("staging: Add rtl8723bs sdio wifi driver").

Reported by: Pietro Oliva <pietroliva@gmail.com>
Cc: Pietro Oliva <pietroliva@gmail.com>
Cc: Stable <stable@vger.kernel.org>
Fixes: 554c0a3abf ("staging: Add rtl8723bs sdio wifi driver").
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Link: https://lore.kernel.org/r/20200210180235.21691-5-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-28 16:38:48 +01:00
..
accessibility
…
acpi
ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch
2020-02-24 08:34:45 +01:00
amba
…
android
…
ata
ahci: Do not export local variable ahci_em_messages
2020-01-27 14:51:07 +01:00
atm
fore200e: Fix incorrect checks of NULL pointer dereference
2020-02-24 08:34:42 +01:00
auxdisplay
…
base
driver core: platform: fix u32 greater or equal to zero comparison
2020-02-24 08:34:50 +01:00
bcma
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-27 14:51:09 +01:00
block
floppy: check FDC index for errors before assigning it
2020-02-28 16:38:45 +01:00
bluetooth
…
bus
bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated
2020-01-27 14:50:36 +01:00
cdrom
…
char
char/random: silence a lockdep splat with printk()
2020-02-24 08:34:36 +01:00
clk
clk: uniphier: Add SCSSI clock gate for each channel
2020-02-24 08:34:45 +01:00
clocksource
clocksource/drivers/bcm2835_timer: Fix memory leak of timer
2020-02-24 08:34:37 +01:00
connector
…
cpufreq
cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
2020-01-27 14:50:53 +01:00
cpuidle
…
crypto
crypto: chtls - Fixed memory leak
2020-02-24 08:34:44 +01:00
dax
…
dca
…
devfreq
PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
2020-02-24 08:34:44 +01:00
dio
…
dma
dmaengine: imx-sdma: Fix memory leak
2020-02-24 08:34:44 +01:00
dma-buf
…
edac
EDAC/mc: Fix edac_mc_find() in case no device is found
2020-01-27 14:50:48 +01:00
eisa
…
extcon
…
firewire
…
firmware
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
2020-01-27 14:51:19 +01:00
fmc
…
fpga
…
fsi
fsi: sbefifo: Don't fail operations when in SBE IPL state
2020-01-27 14:51:00 +01:00
gnss
…
gpio
gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_irq_map/unmap()
2020-02-24 08:34:36 +01:00
gpu
drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c (v2)
2020-02-24 08:34:54 +01:00
hid
HID: steam: Fix input device disappearing
2020-02-01 09:37:09 +00:00
hsi
…
hv
hv_balloon: Balloon up according to request page number
2020-02-11 04:34:01 -08:00
hwmon
hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
2020-02-19 19:51:59 +01:00
hwspinlock
…
hwtracing
coresight: tmc-etf: Do not call smp_processor_id from preemptible
2020-01-29 16:43:23 +01:00
i2c
i2c: stm32f7: report dma error during probe
2020-01-27 14:51:21 +01:00
ide
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-24 08:34:49 +01:00
idle
…
iio
iio: st_gyro: Correct data for LSM9DS0 gyro
2020-02-01 09:37:04 +00:00
infiniband
IB/hfi1: Add software counter for ctxt0 seq drop
2020-02-24 08:34:46 +01:00
input
Input: edt-ft5x06 - work around first register access error
2020-02-24 08:34:46 +01:00
iommu
iommu/qcom: Fix bogus detach logic
2020-02-28 16:38:43 +01:00
ipack
…
irqchip
irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
2020-02-24 08:34:53 +01:00
isdn
…
leds
leds: pca963x: Fix open-drain initialization
2020-02-24 08:34:35 +01:00
lightnvm
lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
2020-01-27 14:50:45 +01:00
macintosh
…
mailbox
mailbox: qcom-apcs: fix max_register value
2020-01-27 14:51:14 +01:00
mcb
…
md
bcache: explicity type cast in bset_bkey_last()
2020-02-24 08:34:53 +01:00
media
media: cx23885: Add support for AVerMedia CE310B
2020-02-24 08:34:41 +01:00
memory
…
memstick
…
message
…
mfd
mfd: rn5t618: Mark ADC control register volatile
2020-02-11 04:34:14 -08:00
misc
mei: me: add comet point (lake) H device ids
2020-02-01 09:37:04 +00:00
mmc
mmc: sdhci-of-at91: fix memleak on clk_get failure
2020-02-11 04:34:00 -08:00
mtd
mtd: sharpslpart: Fix unsigned comparison to zero
2020-02-14 16:33:27 -05:00
mux
…
net
mlxsw: spectrum_dpipe: Add missing error path
2020-02-24 08:34:54 +01:00
nfc
NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu().
2020-02-24 08:34:40 +01:00
ntb
ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev()
2020-01-27 14:50:55 +01:00
nubus
…
nvdimm
…
nvme
nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info
2020-02-19 19:51:57 +01:00
nvmem
nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm
2020-01-27 14:50:58 +01:00
of
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
2020-02-11 04:34:03 -08:00
opp
…
oprofile
…
parisc
…
parport
…
pci
PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
2020-02-24 08:34:41 +01:00
pcmcia
…
perf
…
phy
phy: qualcomm: Adjust indentation in read_poll_timeout
2020-02-11 04:34:12 -08:00
pinctrl
pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
2020-02-24 08:34:44 +01:00
platform
platform/x86: intel_mid_powerbtn: Take a copy of ddata
2020-02-14 16:33:25 -05:00
pnp
…
power
power: supply: ltc2941-battery-gauge: fix use-after-free
2020-02-11 04:34:02 -08:00
powercap
…
pps
…
ps3
…
ptp
…
pwm
pwm: Remove set but not set variable 'pwm'
2020-02-24 08:34:49 +01:00
rapidio
drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
2020-01-27 14:50:31 +01:00
ras
…
regulator
regulator: rk808: Lower log level on optional GPIOs being not available
2020-02-24 08:34:40 +01:00
remoteproc
remoteproc: Initialize rproc_class before use
2020-02-24 08:34:50 +01:00
reset
reset: uniphier: Add SCSSI reset control for each channel
2020-02-24 08:34:44 +01:00
rpmsg
…
rtc
rtc: cmos: Stop using shared IRQ
2020-02-14 16:33:24 -05:00
s390
s390/qeth: Fix initialization of vnicc cmd masks during set online
2020-01-27 14:51:18 +01:00
sbus
…
scsi
scsi: iscsi: Don't destroy session if there are outstanding connections
2020-02-24 08:34:48 +01:00
sfi
…
sh
…
siox
…
slimbus
…
sn
…
soc
soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
2020-02-24 08:34:46 +01:00
soundwire
…
spi
spi: spi-mem: Fix inverted logic in op sanity check
2020-02-14 16:33:24 -05:00
spmi
…
ssb
…
staging
staging: rtl8723bs: Fix potential overuse of kernel memory
2020-02-28 16:38:48 +01:00
target
scsi: RDMA/isert: Fix a recently introduced regression related to logout
2020-01-29 16:43:21 +01:00
tc
…
tee
tee: optee: Fix compilation issue with nommu
2020-02-05 14:43:50 +00:00
thermal
thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
2020-01-27 14:50:48 +01:00
thunderbolt
thunderbolt: Prevent crash if non-active NVMem file is read
2020-02-28 16:38:44 +01:00
tty
vt: vt_ioctl: fix race in VT_RESIZEX
2020-02-28 16:38:45 +01:00
uio
uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
2020-02-24 08:34:37 +01:00
usb
usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields
2020-02-28 16:38:47 +01:00
uwb
…
vfio
vfio/mdev: Fix aborting mdev child device removal if one fails
2020-01-27 14:50:46 +01:00
vhost
vhost/test: stop device before reset
2020-01-27 14:51:19 +01:00
video
pxa168fb: Fix the function used to release some memory in an error handling path
2020-02-24 08:34:36 +01:00
virt
…
virtio
virtio_balloon: prevent pfn array overflow
2020-02-24 08:34:54 +01:00
visorbus
visorbus: fix uninitialized variable access
2020-02-24 08:34:47 +01:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-24 08:34:47 +01:00
w1
…
watchdog
watchdog: fix UAF in reboot notifier handling in watchdog core code
2020-02-11 04:34:08 -08:00
xen
xen/balloon: Support xend-based toolstack take two
2020-02-11 04:34:08 -08:00
zorro
…
Kconfig
…
Makefile
…