Marc Zyngier
ac48d8300e
HID: core: Sanitize event code and type when mapping input ...
commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.
When calling into hid_map_usage(), the passed event code is
blindly stored as is, even if it doesn't fit in the associated bitmap.
This event code can come from a variety of sources, including devices
masquerading as input devices, only a bit more "programmable".
Instead of taking the event code at face value, check that it actually
fits the corresponding bitmap, and if it doesn't:
- spit out a warning so that we know which device is acting up
- NULLify the bitmap pointer so that we catch unexpected uses
Code paths that can make use of untrusted inputs can now check
that the mapping was indeed correct and bail out if not.
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 11:47:31 +02:00
ACPICA: Do not increment operation_region reference counts for field units
2020-08-21 11:01:59 +02:00
binder: Prevent context manager from incrementing ref 0
2020-08-21 11:01:55 +02:00
ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
2020-06-30 15:38:43 -04:00
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
2020-08-21 11:01:55 +02:00
device property: Fix the secondary firmware node handling in set_primary_fwnode()
2020-09-03 11:21:22 +02:00
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-29 10:24:31 +01:00
virtio-blk: free vblk-vqs in error path of virtblk_probe()
2020-07-09 09:35:56 +02:00
Bluetooth: btusb: fix PM leak in error case of setup
2020-01-12 11:24:16 +01:00
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
2020-04-24 07:58:46 +02:00
cdrom: respect device capabilities during opening action
2020-01-04 13:41:02 +01:00
agp/intel: Fix a memory leak on module initialisation failure
2020-08-21 11:01:59 +02:00
clk: clk-atlas6: fix return value check in atlas6_clk_init()
2020-08-21 11:02:10 +02:00
clocksource: dw_apb_timer_of: Fix missing clockevent timers
2020-06-20 10:24:14 +02:00
cpufreq: powernv: Fix use-after-free
2020-04-24 07:58:59 +02:00
cpuidle: Fix three reference count leaks
2020-06-20 10:24:18 +02:00
crypto: ccp - Fix use of merged scatterlists
2020-08-21 11:02:05 +02:00
PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
2020-02-28 15:42:28 +01:00
dmaengine: ioat setting ioat timeout as module parameter
2020-07-31 16:44:03 +02:00
dma-buf: Fix memory leak in sync_file_merge()
2019-12-21 10:42:32 +01:00
EDAC/ie31200: Fallback if host bridge device is already initialized
2020-09-03 11:21:18 +02:00
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-30 15:38:28 -04:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
efi: Make it possible to disable efivar_ssdt entirely
2020-07-09 09:35:57 +02:00
gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...)
2020-08-21 11:01:56 +02:00
drm/nouveau: Fix reference count leak in nouveau_connector_detect
2020-09-03 11:21:17 +02:00
HID: core: Sanitize event code and type when mapping input
2020-09-12 11:47:31 +02:00
hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
2020-07-22 09:10:53 +02:00
intel_th: Fix user-visible error codes
2020-04-02 17:20:25 +02:00
i2c: rcar: in slave mode, clear NACK earlier
2020-09-03 11:21:19 +02:00
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-28 15:42:36 +01:00
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
2020-08-21 11:02:07 +02:00
RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
2020-06-30 15:38:42 -04:00
Input: psmouse - add a newline when printing 'proto' by sysfs
2020-08-26 10:29:04 +02:00
iommu/iova: Don't BUG on invalid PFNs
2020-09-03 11:21:16 +02:00
irqchip/gic: Atomically update affinity
2020-07-22 09:10:54 +02:00
staging: gigaset: add endpoint-type sanity check
2019-12-21 10:41:50 +01:00
leds: core: Flush scheduled work for system suspend
2020-08-21 11:02:01 +02:00
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-20 10:24:21 +02:00
mailbox: handle failed named mailbox channel request
2019-08-04 09:33:41 +02:00
overflow.h: Add allocation size calculation helpers
2020-09-03 11:21:22 +02:00
media: davinci: vpif_capture: fix potential double free
2020-09-03 11:21:18 +02:00
memory: tegra: Fix integer overflow on tick value calculation
2019-05-25 18:26:49 +02:00
memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
2019-10-29 09:15:25 +01:00
scsi: mptscsih: Fix read sense data size
2020-07-22 09:10:45 +02:00
mfd: dln2: Run event handler loop under spinlock
2020-08-21 11:02:11 +02:00
cxl: Fix kobject memleak
2020-08-21 11:02:00 +02:00
mmc: sdhci-esdhc-imx: fix the mask for tuning start point
2020-06-20 10:24:18 +02:00
mtd: properly check all write ioctls for permissions
2020-08-21 11:01:54 +02:00
net: gianfar: Add of_node_put() before goto statement
2020-09-03 11:21:20 +02:00
nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
2020-08-21 11:01:51 +02:00
ntb: intel: fix return value for ndev_vec_mask()
2019-11-28 18:28:52 +01:00
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
2020-05-27 16:42:00 +02:00
nvme: retain split access workaround for capability reads
2020-01-29 10:24:33 +01:00
nvmem: qfprom: remove incorrect write support
2020-06-11 09:22:22 +02:00
of: unittest: kmemleak in of_unittest_platform_populate()
2020-04-24 07:59:10 +02:00
parisc: mask out enable and reserved bits from sba imask
2020-08-21 11:02:06 +02:00
parport: load lowlevel driver if ports not found
2020-01-04 13:39:55 +01:00
PCI: Fix pci_create_slot() reference count leak
2020-09-03 11:21:17 +02:00
drivers/perf: arm_pmu: Fix failure path in PM notifier
2019-08-06 18:29:41 +02:00
phy: phy-twl4030-usb: fix denied runtime access
2019-11-25 09:52:50 +01:00
pinctrl-single: fix pcs_parse_pinconf() return value
2020-08-21 11:02:04 +02:00
platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
2020-08-21 11:01:57 +02:00
power: supply: check if calc_soc succeeded in pm860x_init_battery
2020-08-21 11:02:03 +02:00
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
2019-08-04 09:33:45 +02:00
ptp: free ptp device pin descriptors properly
2020-05-20 08:15:33 +02:00
pwm: bcm-iproc: handle clk_get_rate() return
2020-08-21 11:02:10 +02:00
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 16:42:02 +02:00
regulator: rk808: Lower log level on optional GPIOs being not available
2020-02-28 15:42:23 +01:00
remoteproc: Fix wrong rvring index computation
2020-05-02 17:23:14 +02:00
reset: Fix potential use-after-free in __of_reset_control_get()
2019-11-25 09:53:42 +01:00
rtc: pm8xxx: Fix issue in RTC write path
2020-04-24 07:59:09 +02:00
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-03 11:21:19 +02:00
scsi: ufs: Improve interrupt handling for shared interrupts
2020-09-03 11:21:20 +02:00
soc: qcom: smem: Use le32_to_cpu for comparison
2020-04-24 07:59:10 +02:00
spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
2020-07-22 09:10:50 +02:00
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
2019-05-31 06:48:12 -07:00
cec-api: prevent leaking memory through hole in structure
2020-09-03 11:21:17 +02:00
scsi: target: tcmu: Fix crash on ARM during cmd completion
2020-09-03 11:21:16 +02:00
Revert "thermal: mediatek: fix register index error"
2020-07-22 09:10:51 +02:00
thunderbolt: Use 32-bit writes when writing ring producer/consumer
2019-11-06 12:18:14 +01:00
serial: 8250: change lock order in serial8250_do_startup()
2020-09-03 11:21:21 +02:00
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb: storage: Add unusual_uas entry for Sony PSZ drives
2020-09-03 11:21:23 +02:00
vfio-pci: Mask cap zero
2020-06-30 15:38:25 -04:00
vhost: vsock: kick send_pkt worker once device is started
2020-05-10 10:28:00 +02:00
fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-03 11:21:20 +02:00
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
2019-05-16 19:43:47 +02:00
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:29:05 +02:00
vme: bridges: reduce stack usage
2020-02-28 15:42:33 +01:00
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-20 10:24:22 +02:00
watchdog: f71808e_wdt: clear watchdog timeout occurred flag
2020-08-21 11:02:09 +02:00
XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-03 11:21:21 +02:00
ac48d8300e