TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e24ef3003b80830193731fde509e2bfda645029c
twx-linux/drivers
T
History
Rustam Kovhaev 5a023e34ee staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb() 
commit fea22e159d upstream.

let's use usb_find_common_endpoints() to discover endpoints, it does all
necessary checks for type and xfer direction

remove memset() in hfa384x_create(), because we now assign endpoints in
prism2sta_probe_usb() and because create_wlan() uses kzalloc() to
allocate hfa384x struct before calling hfa384x_create()

Fixes: faaff97656 ("staging: wlan-ng: properly check endpoint types")
Reported-and-tested-by: syzbot+22794221ab96b0bab53a@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=22794221ab96b0bab53a
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200804145614.104320-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-23 10:46:30 +02:00
..
accessibility
…
acpi
ACPICA: Do not increment operation_region reference counts for field units
2020-08-21 09:48:06 +02:00
amba
…
android
binder: Prevent context manager from incrementing ref 0
2020-08-21 09:47:58 +02:00
ata
libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
2020-09-09 19:03:12 +02:00
atm
firestream: Fix memleak in fs_open
2020-09-23 10:46:26 +02:00
auxdisplay
…
base
device property: Fix the secondary firmware node handling in set_primary_fwnode()
2020-09-03 11:22:32 +02:00
bcma
…
block
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-09 19:03:12 +02:00
bluetooth
Bluetooth: hci_serdev: Only unregister device if it was registered
2020-08-21 09:48:11 +02:00
bus
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
2020-04-24 08:00:23 +02:00
cdrom
…
char
tpm: Unify the mismatching TPM space buffer sizes
2020-09-03 11:22:34 +02:00
clk
clk: Evict unregistered clks from parent caches
2020-08-26 10:30:00 +02:00
clocksource
clocksource: dw_apb_timer_of: Fix missing clockevent timers
2020-06-20 10:25:08 +02:00
connector
…
cpufreq
cpufreq: intel_pstate: Refuse to turn off with HWP enabled
2020-09-23 10:46:27 +02:00
cpuidle
cpuidle: Fixup IRQ state
2020-09-09 19:03:06 +02:00
crypto
crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
2020-08-21 09:48:14 +02:00
dax
…
dca
…
devfreq
Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
2020-03-11 18:02:50 +01:00
dio
…
dma
dmaengine: acpi: Put the CSRT table after using it
2020-09-23 10:46:26 +02:00
dma-buf
…
edac
EDAC/ie31200: Fallback if host bridge device is already initialized
2020-09-03 11:22:27 +02:00
eisa
…
extcon
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-25 15:41:55 +02:00
firewire
…
firmware
efi: Make it possible to disable efivar_ssdt entirely
2020-07-09 09:36:33 +02:00
fmc
…
fpga
…
fsi
…
gpio
gpio: arizona: put pm_runtime in case of failure
2020-07-29 07:42:51 +02:00
gpu
drm/msm: add shutdown support for display platform_driver
2020-09-09 19:03:06 +02:00
hid
HID: core: Sanitize event code and type when mapping input
2020-09-09 19:03:06 +02:00
hsi
…
hv
Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
2020-08-21 09:48:00 +02:00
hwmon
hwmon: (applesmc) check status earlier.
2020-09-09 19:03:06 +02:00
hwspinlock
…
hwtracing
coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
2020-08-21 09:48:10 +02:00
i2c
i2c: rcar: in slave mode, clear NACK earlier
2020-09-03 11:22:29 +02:00
ide
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-09 19:03:12 +02:00
idle
…
iio
iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
2020-09-23 10:46:29 +02:00
infiniband
RDMA/core: Fix reported speed and width
2020-09-23 10:46:25 +02:00
input
Input: psmouse - add a newline when printing 'proto' by sysfs
2020-08-26 10:29:56 +02:00
iommu
iommu/vt-d: Serialize IOMMU GCMD register modifications
2020-09-09 19:03:10 +02:00
ipack
…
irqchip
genirq/affinity: Make affinity setting if activated opt-in
2020-08-21 09:48:23 +02:00
isdn
…
leds
leds: core: Flush scheduled work for system suspend
2020-08-21 09:48:09 +02:00
lightnvm
…
macintosh
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-20 10:25:19 +02:00
mailbox
…
mcb
…
md
dm thin metadata: Avoid returning cmd->bm wild pointer on error
2020-09-09 19:03:12 +02:00
media
media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
2020-09-03 11:22:28 +02:00
memory
…
memstick
…
message
scsi: mptscsih: Fix read sense data size
2020-07-22 09:22:16 +02:00
mfd
mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
2020-09-03 11:22:24 +02:00
misc
cxl: Fix kobject memleak
2020-08-21 09:48:08 +02:00
mmc
mmc: sdhci-msm: Add retries when all tuning phases are found valid
2020-09-23 10:46:26 +02:00
mtd
mtd: rawnand: qcom: avoid write to unavailable register
2020-08-21 09:48:15 +02:00
mux
…
net
drivers/net/wan/hdlc_cisco: Add hard_header_len
2020-09-23 10:46:27 +02:00
nfc
NFC: st95hf: Fix memleak in st95hf_in_send_cmd
2020-09-23 10:46:26 +02:00
ntb
NTB: Fix the default port and peer numbers for legacy drivers
2020-06-25 15:41:50 +02:00
nubus
…
nvdimm
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-09 19:03:12 +02:00
nvme
nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()'
2020-09-09 19:03:09 +02:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-06-11 09:23:01 +02:00
of
of: of_mdio: Correct loop scanning logic
2020-07-22 09:22:23 +02:00
oprofile
…
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-21 09:48:16 +02:00
parport
…
pci
PCI: Fix pci_create_slot() reference count leak
2020-09-03 11:22:26 +02:00
pcmcia
…
perf
drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
2020-04-02 16:34:14 +02:00
phy
phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
2020-07-22 09:22:24 +02:00
pinctrl
pinctrl-single: fix pcs_parse_pinconf() return value
2020-08-21 09:48:13 +02:00
platform
platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
2020-08-21 09:48:03 +02:00
pnp
…
power
power: supply: check if calc_soc succeeded in pm860x_init_battery
2020-08-21 09:48:11 +02:00
powercap
…
pps
…
ps3
…
ptp
…
pwm
pwm: bcm-iproc: handle clk_get_rate() return
2020-08-21 09:48:21 +02:00
rapidio
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 16:43:12 +02:00
ras
…
regulator
regulator: rk808: Lower log level on optional GPIOs being not available
2020-02-28 16:35:59 +01:00
remoteproc
remoteproc: Fix IDR initialisation in rproc_alloc()
2020-06-25 15:41:47 +02:00
reset
…
rpmsg
rpmsg: glink: smem: Ensure ordering during tx
2020-04-24 08:01:06 +02:00
rtc
rtc: goldfish: Enable interrupt in set_alarm() when necessary
2020-08-26 10:29:55 +02:00
s390
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-03 11:22:30 +02:00
sbus
…
scsi
scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
2020-09-23 10:46:25 +02:00
sfi
…
sh
…
sn
…
soc
soc: imx: gpc: fix power up sequencing
2020-04-24 08:01:18 +02:00
spi
spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
2020-09-03 11:22:29 +02:00
spmi
…
ssb
…
staging
staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
2020-09-23 10:46:30 +02:00
target
scsi: target: tcmu: Fix crash on ARM during cmd completion
2020-09-03 11:22:25 +02:00
tc
…
tee
…
thermal
thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
2020-09-09 19:03:10 +02:00
thunderbolt
thunderbolt: Prevent crash if non-active NVMem file is read
2020-02-28 16:36:09 +01:00
tty
serial: 8250: change lock order in serial8250_do_startup()
2020-09-03 11:22:31 +02:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:22:27 +02:00
usb
usb: storage: Add unusual_uas entry for Sony PSZ drives
2020-09-03 11:22:34 +02:00
uwb
…
vfio
vfio/pci: Fix SR-IOV VF handling with MMIO blocking
2020-09-12 13:39:11 +02:00
vhost
vhost/vsock: fix packet delivery order to monitoring devices
2020-05-27 16:42:56 +02:00
video
fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-03 11:22:30 +02:00
virt
…
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:29:57 +02:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-28 16:36:04 +01:00
w1
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-20 10:25:20 +02:00
watchdog
watchdog: f71808e_wdt: clear watchdog timeout occurred flag
2020-08-21 09:48:19 +02:00
xen
xen/xenbus: Fix granting of vmalloc'd memory
2020-09-09 19:03:07 +02:00
zorro
…
Kconfig
…
Makefile
…