TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
v4.14.120
twx-linux/drivers
T
History
Dan Carpenter 1a3a561df5 drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl 
commit 6a02433065 upstream.

The "param.count" value is a u64 thatcomes from the user.  The code
later in the function assumes that param.count is at least one and if
it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR.

Also the addition can have an integer overflow which would lead us to
allocate a smaller "pages" array than required.  I can't immediately
tell what the possible run times implications are, but it's safest to
prevent the overflow.

Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam
Fixes: 6db7199407 ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Timur Tabi <timur@freescale.com>
Cc: Mihai Caraman <mihai.caraman@freescale.com>
Cc: Kumar Gala <galak@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-16 19:42:35 +02:00
..
accessibility
…
acpi
ACPICA: Namespace: remove address node from global list after method termination
2019-05-16 19:42:30 +02:00
amba
…
android
binder: fix handling of misaligned binder object
2019-05-02 09:40:31 +02:00
ata
libata: fix using DMA buffers on stack
2019-05-04 09:15:22 +02:00
atm
…
auxdisplay
auxdisplay: hd44780: Fix memory leak on ->remove()
2019-04-20 09:15:00 +02:00
base
devres: Align data[] to ARCH_KMALLOC_MINALIGN
2019-05-16 19:42:29 +02:00
bcma
…
block
virtio-blk: limit number of hw queues by nr_cpu_ids
2019-05-10 17:53:12 +02:00
bluetooth
Bluetooth: btusb: request wake pin with NOAUTOEN
2019-05-08 07:20:51 +02:00
bus
…
cdrom
cdrom: Fix race condition in cdrom_sysctl_register
2019-04-05 22:31:35 +02:00
char
tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
2019-04-27 09:35:40 +02:00
clk
clk: x86: Add system specific quirk to mark clocks as critical
2019-05-08 07:20:53 +02:00
clocksource
clocksource/drivers/oxnas: Fix OX820 compatible
2019-05-16 19:42:21 +02:00
connector
…
cpufreq
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
cpuidle
…
crypto
crypto: crypto4xx - properly set IV after de- and encrypt
2019-04-27 09:35:39 +02:00
dax
…
dca
…
devfreq
…
dio
…
dma
dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
2019-05-02 09:40:30 +02:00
dma-buf
…
edac
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
eisa
…
extcon
…
firewire
…
firmware
efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
2019-04-05 22:31:36 +02:00
fmc
…
fpga
…
fsi
…
gpio
gpio: of: Fix of_gpiochip_add() error path
2019-05-04 09:15:22 +02:00
gpu
drm/rockchip: fix for mailbox read validation.
2019-05-16 19:42:30 +02:00
hid
HID: input: add mapping for "Toggle Display" key
2019-05-16 19:42:20 +02:00
hsi
…
hv
Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup()
2019-05-10 17:53:08 +02:00
hwmon
hwmon: (pwm-fan) Disable PWM if fetching cooling data fails
2019-05-16 19:42:19 +02:00
hwspinlock
…
hwtracing
intel_th: pci: Add Comet Lake support
2019-05-10 17:53:14 +02:00
i2c
i2c: i2c-stm32f7: Fix SDADEL minimum formula
2019-05-08 07:20:53 +02:00
ide
…
idle
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
iio
iio: adc: xilinx: fix potential use-after-free on remove
2019-05-16 19:42:19 +02:00
infiniband
RDMA/vmw_pvrdma: Return the correct opcode when creating WR
2019-05-16 19:42:29 +02:00
input
Input: elan_i2c - add hardware ID for multiple Lenovo laptops
2019-05-16 19:42:30 +02:00
iommu
iommu/amd: Set exclusion range correctly
2019-05-10 17:53:13 +02:00
ipack
…
irqchip
MIPS: perf: ath79: Fix perfcount IRQ assignment
2019-05-16 19:42:23 +02:00
isdn
mISDN: Check address length before reading address family
2019-05-16 19:42:21 +02:00
leds
leds: pwm: silently error out on EPROBE_DEFER
2019-05-16 19:42:29 +02:00
lightnvm
…
macintosh
…
mailbox
…
mcb
…
md
Don't jump to compute_result state from check_result state
2019-05-16 19:42:33 +02:00
media
media: ov5640: fix auto controls values when switching to manual mode
2019-05-16 19:42:27 +02:00
memory
…
memstick
…
message
…
mfd
…
misc
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:15:06 +02:00
mmc
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
mtd
…
mux
…
net
net: ucc_geth - fix Oops when changing number of buffers in the ring
2019-05-16 19:42:34 +02:00
nfc
spi: ST ST95HF NFC: declare missing of table
2019-05-16 19:42:24 +02:00
ntb
…
nubus
…
nvdimm
libnvdimm/btt: Fix a kmemdup failure check
2019-05-16 19:42:20 +02:00
nvme
nvme-loop: init nvmet_ctrl fatal_err_work when allocate
2019-05-08 07:20:47 +02:00
nvmem
…
of
…
oprofile
…
parisc
…
parport
parport_pc: fix find_superio io compare code, should use equal test.
2019-03-23 14:35:24 +01:00
pci
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
pcmcia
…
perf
…
phy
phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
2019-04-03 06:25:19 +02:00
pinctrl
…
platform
platform/x86: thinkpad_acpi: Disable Bluetooth for some machines
2019-05-16 19:42:19 +02:00
pnp
…
power
power: supply: charger-manager: Fix incorrect return value
2019-03-27 14:13:55 +09:00
powercap
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
pps
…
ps3
…
ptp
…
pwm
…
rapidio
…
ras
…
regulator
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
2019-04-05 22:31:39 +02:00
remoteproc
…
reset
…
rpmsg
…
rtc
rtc: da9063: set uie_unsupported when relevant
2019-05-08 07:20:49 +02:00
s390
s390: ctcm: fix ctcm_new_device error return code
2019-05-16 19:42:24 +02:00
sbus
…
scsi
scsi: raid_attrs: fix unused variable warning
2019-05-16 19:42:27 +02:00
sfi
…
sh
…
sn
…
soc
soc/tegra: pmc: Drop locking from tegra_powergate_is_powered()
2019-04-20 09:15:06 +02:00
spi
…
spmi
…
ssb
…
staging
staging: olpc_dcon: add a missing dependency
2019-05-16 19:42:28 +02:00
target
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
2019-03-23 14:35:20 +01:00
tc
…
tee
…
thermal
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:18:42 +02:00
thunderbolt
…
tty
vt: always call notifier with the console lock held
2019-05-16 19:42:29 +02:00
uio
…
usb
USB: serial: fix unthrottle races
2019-05-16 19:42:19 +02:00
uwb
…
vfio
vfio/pci: use correct format characters
2019-05-08 07:20:49 +02:00
vhost
vhost: reject zero size iova range
2019-04-27 09:35:34 +02:00
video
backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state
2019-04-05 22:31:37 +02:00
virt
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
2019-05-16 19:42:35 +02:00
virtio
virtio_pci: fix a NULL pointer reference in vp_del_vqs
2019-05-10 17:53:11 +02:00
vlynq
…
vme
…
w1
USB: w1 ds2490: Fix bug caused by improper use of altsetting array
2019-05-08 07:20:46 +02:00
watchdog
…
xen
…
zorro
…
Kconfig
…
Makefile
…