Dave Carroll
fa00c437ee
aacraid: Check size values after double-fetch from user ...
In aacraid's ioctl_send_fib() we do two fetches from userspace, one the
get the fib header's size and one for the fib itself. Later we use the
size field from the second fetch to further process the fib. If for some
reason the size from the second fetch is different than from the first
fix, we may encounter an out-of- bounds access in aac_fib_send(). We
also check the sender size to insure it is not out of bounds. This was
reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was
assigned CVE-2016-6480.
Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Fixes: 7c00ffa31stable@vger.kernel.org
Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-08-08 21:34:02 -04:00
Merge branches 'acpica-fixes', 'acpi-pci-fixes' and 'acpi-debug-fixes'
2016-07-07 23:37:37 +02:00
ARM: 8566/1: drivers: amba: properly handle devices with power domains
2016-05-05 19:00:40 +01:00
Merge branch 'for-4.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
2016-06-28 12:11:31 -07:00
atm: iphase: off by one in rx_pkt()
2016-05-31 11:52:59 -07:00
Driver core fixes for 4.7-rc4
2016-06-18 06:04:01 -10:00
MTD updates for v4.7:
2016-05-24 11:00:20 -07:00
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
2016-07-07 15:34:09 -07:00
Bluetooth: Add USB ID 13D3:3487 to ath3k
2016-05-13 16:54:59 +02:00
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
2016-05-19 10:02:26 -07:00
ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()
2016-06-13 08:56:28 -05:00
A bunch of fixes. Some for the newly added rk3399 clock tree, some
2016-06-20 17:01:45 -07:00
Small release overall.
2016-05-19 11:27:09 -07:00
connector: fix out-of-order cn_proc netlink message delivery
2016-06-28 08:48:33 -04:00
cpufreq: Avoid false-positive WARN_ON()s in cpufreq_update_policy()
2016-06-28 03:29:29 +02:00
cpuidle: Fix last_residency division
2016-07-04 14:17:34 +02:00
crypto: ux500 - memmove the right size
2016-06-13 17:43:05 +08:00
/dev/dax, core: file operations and dax-mmap
2016-05-20 22:02:55 -07:00
PM / devfreq: Send the DEVFREQ_POSTCHANGE notification when target() is failed
2016-06-23 23:15:12 +02:00
dmaengine: mv_xor: Fix incorrect offset in dma_map_page()
2016-06-07 12:44:23 +05:30
dma-buf: use vma_pages()
2016-05-31 22:17:05 +05:30
EDAC, sb_edac: Readd accidentally dropped Broadwell-D support
2016-06-03 17:28:21 +02:00
extcon: palmas: Fix boot up state of VBUS when using GPIO detection
2016-06-15 17:17:22 +09:00
treewide: replace dev->trans_start update with helper
2016-05-04 14:16:49 -04:00
efi/arm: Fix the format of EFI debug messages
2016-06-03 09:57:36 +02:00
Revert "gpio: gpiolib-of: Allow compile testing"
2016-07-05 19:03:04 +02:00
Allwinner DRM driver fixes for 4.7, take 2
2016-07-08 13:29:11 +10:00
HID: multitouch: enable palm rejection for Windows Precision Touchpad
2016-06-28 13:24:14 +02:00
HSI: omap-ssi: move omap_ssi_port_update_fclk
2016-05-09 22:45:18 +02:00
hwmon: (dell-smm) Cache fan_type() calls and change fan detection
2016-06-23 06:24:23 -07:00
drivers/hwspinlock: use correct radix tree API
2016-05-20 17:58:30 -07:00
coresight: Handle build path error
2016-06-16 00:13:06 -07:00
i2c: mux: reg: Provide of_match_table
2016-06-09 22:38:16 +02:00
iio:ad7266: Fix probe deferral for vref
2016-06-26 17:39:26 +01:00
Merge branches '4.7-rc-misc', 'hfi1-fixes', 'i40iw-rc-fixes' and 'mellanox-rc-fixes' into k.o/for-4.7-rc
2016-06-23 12:22:33 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2016-06-27 20:34:43 -07:00
iommu/amd: Fix unity mapping initialization race
2016-07-06 18:04:55 +02:00
irqchip/mips-gic: Match IPI IRQ domain by bus token only
2016-07-05 16:54:21 +02:00
TTY and Serial driver update for 4.7-rc1
2016-05-20 20:57:27 -07:00
leds: handle suspend/resume in heartbeat trigger
2016-06-08 11:47:06 +02:00
lightnvm: reserved space calculation incorrect
2016-05-06 12:51:10 -06:00
mailbox: Fix devm_ioremap_resource error detection code
2016-05-08 22:44:46 +05:30
mcb: Acquire reference to carrier module in core
2016-06-13 18:49:30 -07:00
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
2016-05-27 14:28:09 -07:00
Update my main e-mails at the Kernel tree
2016-06-15 15:35:37 -10:00
memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
2016-06-16 11:43:48 +03:00
drivers/memstick/core/mspro_block: use kmemdup
2016-05-23 17:04:14 -07:00
SCSI misc on 20160517
2016-05-18 16:38:59 -07:00
mfd: max77620: Fix FPS switch statements
2016-06-30 07:44:23 +01:00
mei: don't use wake_up_interruptible for wr_ctrl
2016-06-10 22:14:24 -07:00
mmc: sunxi: Re-enable eMMC HS-DDR modes on Allwinner A80
2016-06-02 10:40:20 +02:00
ubi: Make recover_peb power cut aware
2016-06-23 00:29:32 +02:00
cxgb4: update latest firmware version supported
2016-07-05 11:53:25 -07:00
NFC: pn533: handle interrupted commands in pn533_recv_frame
2016-05-10 00:01:47 +02:00
libnvdimm, pfn, dax: fix initialization vs autodetect for mode + alignment
2016-06-23 17:50:39 -07:00
NVMe: Only release requested regions
2016-06-09 14:28:28 -06:00
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
drivers/of: Fix depth for sub-tree blob in unflatten_dt_nodes()
2016-06-09 14:36:34 -05:00
PCI: Fix unaligned accesses in VC code
2016-06-20 13:24:20 -05:00
arm: pmu: Fix non-devicetree probing
2016-06-15 09:51:35 +01:00
- Final patches fixing Reset API change
2016-07-01 15:17:16 -07:00
pinctrl: baytrail: Fix mingled clock pins
2016-06-23 11:05:04 +02:00
platform/chrome: cros_ec_dev - double fetch bug in ioctl
2016-07-05 14:01:52 -07:00
driver core update for 4.7-rc1
2016-05-20 21:26:15 -07:00
power_supply: tps65217-charger: Fix NULL deref during property export
2016-06-16 15:54:11 +02:00
Power management material for v4.7-rc1
2016-05-16 19:17:22 -07:00
ptp: oops in ptp_ioctl()
2016-05-29 22:32:27 -07:00
pwm: atmel-hlcdc: Fix default PWM polarity
2016-06-14 10:51:45 +02:00
rapidio/mport_cdev: fix uapi type definitions
2016-05-05 17:38:53 -07:00
regulator: Fix qcom-smd list voltage issues for msm8974
2016-07-13 04:22:16 +09:00
remoteproc: Add additional crash reasons
2016-05-12 15:50:19 -07:00
rpmsg: add THIS_MODULE to rpmsg_driver in rpmsg core
2016-05-06 11:08:58 -07:00
rtc: tps6586x: rename so module can be autoloaded
2016-05-21 17:07:17 +02:00
qeth: delete napi struct when removing a qeth device
2016-07-04 23:32:08 -07:00
openprom: fix warning
2016-05-20 18:33:37 -07:00
aacraid: Check size values after double-fetch from user
2016-08-08 21:34:02 -04:00
soc: mtk-pmic-wrap: avoid integer overflow warning
2016-05-19 15:20:24 +02:00
Merge remote-tracking branches 'spi/fix/ep93xx', 'spi/fix/rockchip', 'spi/fix/sunxi' and 'spi/fix/ti-qspi' into spi-linus
2016-06-30 13:17:29 +01:00
staging: iio: accel: fix error check
2016-06-26 15:57:02 +01:00
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
2016-05-28 12:04:17 -07:00
Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux
2016-06-12 06:30:39 -07:00
devpts: fix null pointer dereference on failed memory allocation
2016-06-26 11:39:00 -07:00
- Final patches fixing Reset API change
2016-07-01 15:17:16 -07:00
vfio/pci: Allow VPD short read
2016-05-31 21:25:52 -06:00
target: make close_session optional
2016-05-10 01:19:26 -07:00
OMAPDSS: HDMI5: Change DDC timings
2016-05-31 08:20:43 +03:00
virtio_balloon: fix PFN format for virtio-1
2016-05-22 19:44:13 +03:00
watchdog: ebc-c384_wdt: Allow build for X86_64
2016-06-17 20:21:12 -07:00
xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
2016-07-08 14:53:13 +01:00
libnvdimm for 4.7
2016-05-23 11:18:01 -07:00
/dev/dax, pmem: direct access to persistent memory
2016-05-20 22:02:53 -07:00
fa00c437ee