armbian/linux
0
0
Fork 0
mirror of https://github.com/armbian/linux.git synced 2026-01-06 10:13:00 -08:00
Code Issues Packages Projects Releases Wiki Activity
Files
23bc4e136bca4607f39d65df1ee8ca64359ea2a6
linux/drivers
History
Kees Cook 63db7c91a3 fbdev: color map copying bounds checking 
commit 2dc705a9930b4806250fbf5a76e55266e59389f2 upstream.

Copying color maps to userspace doesn't check the value of to->start,
which will cause kernel heap buffer OOB read due to signedness wraps.

CVE-2016-8405

Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Peter Pi (@heisecode) of Trend Micro
Cc: Min Chong <mchong@google.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-01 08:30:52 +01:00
..
accessibility
…
acpi
ACPI / APEI: Fix NMI notification handling
2017-01-19 20:17:22 +01:00
amba
…
android
ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct
2016-11-10 16:36:33 +01:00
ata
libata: LITE-ON CX1-JB256-HP needs lower max_sectors
2016-08-10 11:49:29 +02:00
atm
…
auxdisplay
…
base
PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend
2017-01-12 11:22:49 +01:00
bcma
x86/quirks: Add early quirk to reset Apple AirPort card
2016-08-10 11:49:24 +02:00
block
loop: return proper error from loop_queue_rq()
2017-01-06 11:16:14 +01:00
bluetooth
Bluetooth: Add support for Intel Bluetooth device 8265 [8087:0a2b]
2016-09-15 08:27:49 +02:00
bus
bus: vexpress-config: fix device reference leak
2017-01-19 20:17:22 +01:00
cdrom
…
char
tpm xen: Remove bogus tpm_chip_unregister
2017-01-06 11:16:16 +01:00
clk
clk: imx31: fix rewritten input argument of mx31_clocks_init()
2017-01-12 11:22:49 +01:00
clocksource
clocksource/exynos_mct: Clear interrupt when cpu is shut down
2017-01-26 08:23:48 +01:00
connector
…
cpufreq
cpufreq: powernv: Disable preemption while checking CPU throttling state
2017-01-19 20:17:22 +01:00
cpuidle
ARM: cpuidle: Fix error return code
2016-10-16 17:36:15 +02:00
crypto
crypto: caam - fix AEAD givenc descriptors
2017-01-06 11:16:12 +01:00
dca
…
devfreq
…
dio
…
dma
dmaengine: pl330: Fix runtime PM support for terminated transfers
2017-01-26 08:23:50 +01:00
dma-buf
…
edac
EDAC: Increment correct counter in edac_inc_ue_error()
2016-09-07 08:32:41 +02:00
eisa
…
extcon
extcon: max77843: Use correct size for reading the interrupt register
2016-05-04 14:48:54 -07:00
firewire
firewire: net: fix fragmented datagram_size off-by-one
2016-11-10 16:36:35 +01:00
firmware
efi: Expose non-blocking set_variable() wrapper to efivars
2016-05-04 14:48:49 -07:00
fmc
…
fpga
…
gpio
gpio: mpc8xxx: Correct irq handler function
2016-10-28 03:01:25 -04:00
gpu
drm/radeon: drop verde dpm quirks
2017-01-19 20:17:21 +01:00
hid
HID: corsair: fix control-transfer error handling
2017-01-26 08:23:48 +01:00
hsi
…
hv
hv: do not lose pending heartbeat vmbus packets
2016-11-10 16:36:34 +01:00
hwmon
hwmon: (g762) Fix overflows and crash seen when writing limit attributes
2017-01-12 11:22:48 +01:00
hwspinlock
…
hwtracing
intel_th: Fix a deadlock in modprobing
2016-08-10 11:49:30 +02:00
i2c
i2c: fix kernel memory disclosure in dev interface
2017-01-19 20:17:20 +01:00
ide
…
idle
intel_idle: Support for Intel Xeon Phi Processor x200 Product Family
2016-09-15 08:27:46 +02:00
iio
iio: orientation: hid-sensor-rotation: Add PM function (fix non working driver)
2016-11-18 10:48:35 +01:00
infiniband
IB/IPoIB: Remove can't use GFP_NOIO warning
2017-01-26 08:23:47 +01:00
input
Input: elants_i2c - avoid divide by 0 errors on bad touchscreen data
2017-01-19 20:17:20 +01:00
iommu
iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped
2017-01-12 11:22:49 +01:00
ipack
…
irqchip
irqchip/bcm7038-l1: Implement irq_cpu_offline() callback
2017-01-12 11:22:49 +01:00
isdn
ser_gigaset: return -ENOMEM on error instead of success
2017-01-15 13:41:34 +01:00
leds
…
lguest
…
lightnvm
lightnvm: put bio before return
2016-09-24 10:07:35 +02:00
macintosh
…
mailbox
…
mcb
mcb: Fixed bar number assignment for the gdd
2016-06-01 12:15:53 -07:00
md
md: MD_RECOVERY_NEEDED is set for mddev->recovery
2017-01-12 11:22:50 +01:00
media
ite-cir: initialize use_demodulator before using it
2017-01-26 08:23:50 +01:00
memory
memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
2016-07-27 09:47:35 -07:00
memstick
memstick: rtsx_usb_ms: Manage runtime PM when accessing the device
2016-10-28 03:01:35 -04:00
message
…
mfd
mfd: core: Fix device reference leak in mfd_clone_cell
2016-11-26 09:54:53 +01:00
misc
mei: bus: fix mei_cldev_enable KDoc
2017-01-12 11:22:47 +01:00
mmc
mmc: mxs-mmc: Fix additional cycles after transmission stop
2017-01-26 08:23:48 +01:00
mtd
mtd: nand: xway: disable module support
2017-01-26 08:23:48 +01:00
net
ieee802154: atusb: do not use the stack for buffers to make them DMA able
2017-01-26 08:23:48 +01:00
nfc
mei: bus: fix received data size check in NFC fixup
2016-11-18 10:48:36 +01:00
ntb
…
nubus
…
nvdimm
libnvdimm, pfn: fix uuid validation
2016-04-20 15:41:54 +09:00
nvme
nvme: Call pci_disable_device on the error path.
2016-09-15 08:27:51 +02:00
nvmem
nvmem: mxs-ocotp: fix buffer overflow in read
2016-05-11 11:21:21 +02:00
of
of: silence warnings due to max() usage
2016-11-15 07:46:39 +01:00
oprofile
…
parisc
…
parport
…
pci
PCI: Enumerate switches below PCI-to-PCIe bridges
2017-01-26 08:23:48 +01:00
pcmcia
pcmcia: db1xxx_ss: fix last irq_to_gpio user
2016-04-20 15:42:09 +09:00
perf
drivers/perf: arm_pmu: Fix leak in error path
2016-10-07 15:23:41 +02:00
phy
phy: core: fix wrong err handle for phy_power_on
2016-03-03 15:07:28 -08:00
pinctrl
pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE
2017-01-19 20:17:23 +01:00
platform
platform/x86: asus-nb-wmi.c: Add X45U quirk
2017-01-09 08:07:50 +01:00
pnp
PNP: Add Broadwell to Intel MCH size workaround
2016-08-16 09:30:48 +02:00
power
power: bq24257: Fix use of uninitialized pointer bq->charger
2016-10-31 04:14:00 -06:00
powercap
…
pps
pps: do not crash when failed to register
2016-08-10 11:49:25 +02:00
ps3
…
ptp
…
pwm
pwm: Fix device reference leak
2016-12-08 07:15:24 +01:00
rapidio
…
ras
…
regulator
regulator: stw481x-vmmc: fix ages old enable error
2017-01-09 08:07:43 +01:00
remoteproc
remoteproc: Fix potential race condition in rproc_add
2016-08-20 18:09:20 +02:00
reset
…
rpmsg
…
rtc
rtc: omap: Fix selecting external osc
2016-11-26 09:54:53 +01:00
s390
s390/vmlogrdr: fix IUCV buffer allocation
2017-01-09 08:07:49 +01:00
sbus
…
scsi
qla2xxx: Fix crash due to null pointer access
2017-01-26 08:23:48 +01:00
sfi
…
sh
drivers: sh: Restore legacy clock domain on SuperH platforms
2016-03-09 15:34:49 -08:00
sn
…
soc
soc: qcom/spm: shut up uninitialized variable warning
2016-09-24 10:07:42 +02:00
spi
spi: mvebu: fix baudrate calculation for armada variant
2017-01-15 13:41:36 +01:00
spmi
…
ssb
ssb: Fix error routine when fallback SPROM fails
2017-01-09 08:07:42 +01:00
staging
staging: comedi: dt282x: tidy up register bit defines
2017-01-12 11:22:50 +01:00
target
target/iscsi: Fix double free in lio_target_tiqn_addtpg()
2017-01-12 11:22:49 +01:00
tc
…
thermal
thermal: hwmon: Properly report critical temperature in sysfs
2017-01-09 08:07:44 +01:00
thunderbolt
thunderbolt: Fix double free of drom buffer
2016-06-01 12:15:53 -07:00
tty
sysrq: attach sysrq handler correctly for 32-bit kernel
2017-01-19 20:17:21 +01:00
uio
uio: fix dmem_region_start computation
2016-10-31 04:13:59 -06:00
usb
USB: serial: ch341: fix modem-control and B0 handling
2017-01-19 20:17:21 +01:00
uwb
uwb: fix device reference leaks
2016-11-26 09:54:53 +01:00
vfio
vfio/pci: Fix NULL pointer oops in error interrupt setup handling
2016-09-07 08:32:37 +02:00
vhost
vhost/scsi: fix reuse of &vq->iov[out] in response
2016-09-15 08:27:53 +02:00
video
fbdev: color map copying bounds checking
2017-02-01 08:30:52 +01:00
virt
…
virtio
virtio_ring: Make interrupt suppression spec compliant
2016-11-10 16:36:34 +01:00
vlynq
…
vme
vme: Fix wrong pointer utilization in ca91cx42_slave_get
2017-01-19 20:17:21 +01:00
w1
w1:omap_hdq: fix regression
2016-08-20 18:09:22 +02:00
watchdog
watchdog: rc32434_wdt: fix ioctl error handling
2016-04-12 09:08:54 -07:00
xen
xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
2017-01-06 11:16:17 +01:00
zorro
…
Kconfig
…
Makefile
…