Johan Hovold 549993001e Input: sur40 - validate number of endpoints before using them ...

commit 92461f5d723037530c1f36cce93640770037812c upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory that lie beyond the end of the endpoint
array should a malicious device lack the expected endpoints.

Fixes: bdb5c57f20 ("Input: add sur40 driver for Samsung SUR40... ")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-03-30 09:35:15 +02:00

..

accessibility

…

acpi

ACPI / video: skip evaluating _DOD when it does not exist

2017-03-26 12:13:17 +02:00

amba

…

android

ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct

2016-11-10 16:36:33 +01:00

ata

libata: apply MAX_SEC_1024 to all CX1-JB*-HP devices

2017-02-09 08:02:45 +01:00

atm

…

auxdisplay

…

base

base/memory, hotplug: fix a kernel oops in show_valid_zones()

2017-02-09 08:02:47 +01:00

bcma

bcma: use (get|put)_device when probing/removing device driver

2017-03-12 06:37:30 +01:00

block

loop: fix LO_FLAGS_PARTSCAN hang

2017-03-12 06:37:27 +01:00

bluetooth

Bluetooth: Add another AR3012 04ca:3018 device

2017-03-15 09:57:11 +08:00

bus

bus: vexpress-config: fix device reference leak

2017-01-19 20:17:22 +01:00

cdrom

…

char

tpm_tis: Use devm_free_irq not free_irq

2017-03-26 12:13:18 +02:00

clk

clk: imx31: fix rewritten input argument of mx31_clocks_init()

2017-01-12 11:22:49 +01:00

clocksource

clocksource/exynos_mct: Clear interrupt when cpu is shut down

2017-01-26 08:23:48 +01:00

connector

…

cpufreq

cpufreq: Fix and clean up show_cpuinfo_cur_freq()

2017-03-26 12:13:19 +02:00

cpuidle

ARM: cpuidle: Fix error return code

2016-10-16 17:36:15 +02:00

crypto

crypto: caam - fix AEAD givenc descriptors

2017-01-06 11:16:12 +01:00

dca

…

devfreq

…

dio

…

dma

dmaengine: ipu: Make sure the interrupt routine checks all interrupts.

2017-03-12 06:37:30 +01:00

dma-buf

…

edac

EDAC: Increment correct counter in edac_inc_ue_error()

2016-09-07 08:32:41 +02:00

eisa

…

extcon

…

firewire

firewire: net: fix fragmented datagram_size off-by-one

2016-11-10 16:36:35 +01:00

firmware

…

fmc

…

fpga

…

gpio

gpio: mpc8xxx: Correct irq handler function

2016-10-28 03:01:25 -04:00

gpu

drm/amdgpu: add missing irq.h include

2017-03-26 12:13:18 +02:00

hid

HID: wacom: Fix poor prox handling in 'wacom_pl_irq'

2017-02-09 08:02:46 +01:00

hsi

…

hv

Drivers: hv: avoid vfree() on crash

2017-03-26 12:13:18 +02:00

hwmon

hwmon: (g762) Fix overflows and crash seen when writing limit attributes

2017-01-12 11:22:48 +01:00

hwspinlock

…

hwtracing

intel_th: Fix a deadlock in modprobing

2016-08-10 11:49:30 +02:00

i2c

i2c: fix kernel memory disclosure in dev interface

2017-01-19 20:17:20 +01:00

ide

…

idle

intel_idle: Support for Intel Xeon Phi Processor x200 Product Family

2016-09-15 08:27:46 +02:00

iio

iio: pressure: mpl3115: do not rely on structure field ordering

2017-03-12 06:37:28 +01:00

infiniband

IB/srp: Fix race conditions related to task management

2017-03-15 09:57:13 +08:00

input

Input: sur40 - validate number of endpoints before using them

2017-03-30 09:35:15 +02:00

iommu

iommu/vt-d: Tylersburg isoch identity map check is done too late.

2017-03-12 06:37:25 +01:00

ipack

…

irqchip

irqchip/bcm7038-l1: Implement irq_cpu_offline() callback

2017-01-12 11:22:49 +01:00

isdn

isdn/gigaset: fix NULL-deref at probe

2017-03-26 12:13:19 +02:00

leds

…

lguest

…

lightnvm

lightnvm: put bio before return

2016-09-24 10:07:35 +02:00

macintosh

…

mailbox

…

mcb

mcb: Fixed bar number assignment for the gdd

2016-06-01 12:15:53 -07:00

md

md/raid1/10: fix potential deadlock

2017-03-26 12:13:19 +02:00

media

media: fix dm1105.c build error

2017-03-12 06:37:24 +01:00

memory

memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing

2016-07-27 09:47:35 -07:00

memstick

memstick: rtsx_usb_ms: Manage runtime PM when accessing the device

2016-10-28 03:01:35 -04:00

message

…

mfd

mfd: core: Fix device reference leak in mfd_clone_cell

2016-11-26 09:54:53 +01:00

misc

mei: bus: fix mei_cldev_enable KDoc

2017-01-12 11:22:47 +01:00

mmc

mmc: core: fix multi-bit bus width without high-speed mode

2017-02-23 17:43:10 +01:00

mtd

mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy

2017-03-18 19:09:56 +08:00

net

net: bcmgenet: remove bcmgenet_internal_phy_setup()

2017-03-30 09:35:14 +02:00

nfc

mei: bus: fix received data size check in NFC fixup

2016-11-18 10:48:36 +01:00

ntb

ntb_transport: Pick an unused queue

2017-02-23 17:43:10 +01:00

nubus

…

nvdimm

nfit, libnvdimm: fix interleave set cookie calculation

2017-03-18 19:09:58 +08:00

nvme

nvme: Call pci_disable_device on the error path.

2016-09-15 08:27:51 +02:00

nvmem

…

of

of: silence warnings due to max() usage

2016-11-15 07:46:39 +01:00

oprofile

…

parisc

…

parport

…

pci

PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies

2017-02-09 08:02:44 +01:00

pcmcia

…

perf

drivers/perf: arm_pmu: Fix leak in error path

2016-10-07 15:23:41 +02:00

phy

…

pinctrl

pinctrl: cherryview: Do not mask all interrupts in probe

2017-03-26 12:13:17 +02:00

platform

goldfish: Sanitize the broken interrupt handler

2017-02-26 11:07:51 +01:00

pnp

PNP: Add Broadwell to Intel MCH size workaround

2016-08-16 09:30:48 +02:00

power

power: bq24257: Fix use of uninitialized pointer bq->charger

2016-10-31 04:14:00 -06:00

powercap

…

pps

pps: do not crash when failed to register

2016-08-10 11:49:25 +02:00

ps3

…

ptp

…

pwm

pwm: pca9685: Fix period change with same duty cycle

2017-03-15 09:57:14 +08:00

rapidio

…

ras

…

regulator

regulator: Fix regulator_summary for deviceless consumers

2017-03-12 06:37:25 +01:00

remoteproc

remoteproc: Fix potential race condition in rproc_add

2016-08-20 18:09:20 +02:00

reset

…

rpmsg

…

rtc

rtc: sun6i: Switch to the external oscillator

2017-03-12 06:37:30 +01:00

s390

s390/dcssblk: fix device size calculation in dcssblk_direct_access()

2017-03-15 09:57:12 +08:00

sbus

…

scsi

scsi: libiscsi: add lock around task lists to fix list corruption regression

2017-03-26 12:13:19 +02:00

sfi

…

sh

…

sn

…

soc

soc: qcom/spm: shut up uninitialized variable warning

2016-09-24 10:07:42 +02:00

spi

spi: mvebu: fix baudrate calculation for armada variant

2017-01-15 13:41:36 +01:00

spmi

…

ssb

ssb: Fix error routine when fallback SPROM fails

2017-01-09 08:07:42 +01:00

staging

staging: rtl: fix possible NULL pointer dereference

2017-03-12 06:37:25 +01:00

target

target: Fix VERIFY_16 handling in sbc_parse_cdb

2017-03-26 12:13:19 +02:00

tc

…

thermal

thermal: hwmon: Properly report critical temperature in sysfs

2017-01-09 08:07:44 +01:00

thunderbolt

thunderbolt: Fix double free of drom buffer

2016-06-01 12:15:53 -07:00

tty

serial: samsung: Continue to work if DMA request fails

2017-03-18 19:09:58 +08:00

uio

uio: fix dmem_region_start computation

2016-10-31 04:13:59 -06:00

usb

USB: don't free bandwidth_mutex too early

2017-03-26 12:13:17 +02:00

uwb

uwb: fix device reference leaks

2016-11-26 09:54:53 +01:00

vfio

vfio/pci: Fix NULL pointer oops in error interrupt setup handling

2016-09-07 08:32:37 +02:00

vhost

vhost/scsi: fix reuse of &vq->iov[out] in response

2016-09-15 08:27:53 +02:00

video

fbdev: color map copying bounds checking

2017-02-01 08:30:52 +01:00

virt

…

virtio

virtio_ring: Make interrupt suppression spec compliant

2016-11-10 16:36:34 +01:00

vlynq

…

vme

vme: Fix wrong pointer utilization in ca91cx42_slave_get

2017-01-19 20:17:21 +01:00

w1

w1: ds2490: USB transfer buffers need to be DMAable

2017-03-12 06:37:29 +01:00

watchdog

…

xen

xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing

2017-01-06 11:16:17 +01:00

zorro

…

Kconfig

…

Makefile

…