mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 16:54:57 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
18c4ef4e765a798b47980555ed665d78b71aeadf
linux/drivers
History
Junjie Cao 18c4ef4e76 fbdev: bitblit: bound-check glyph index in bit_putcs* 
bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
2025-10-28 22:59:19 +01:00
..
accel
accel/qaic: Synchronize access to DBC request queue head & tail pointer
2025-10-14 08:56:31 -06:00
accessibility
…
acpi
Merge tag 'riscv-for-linus-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
2025-10-25 09:35:26 -07:00
amba
…
android
binder: remove "invalid inc weak" check
2025-10-22 08:04:15 +02:00
ata
ata: libata-core: relax checks in ata_read_log_directory()
2025-10-13 09:12:36 +02:00
atm
…
auxdisplay
…
base
arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
2025-10-22 08:06:28 +02:00
bcma
…
block
Merge tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2025-10-24 12:48:19 -07:00
bluetooth
Bluetooth: bcsp: receive data only if registered
2025-09-27 11:37:02 -04:00
bus
Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-04 16:26:32 -07:00
cache
…
cdrom
…
cdx
Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-04 16:26:32 -07:00
char
tpm_crb: Add idle support for the Arm FF-A start method
2025-10-18 14:33:22 +03:00
clk
Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
2025-10-07 09:28:37 -07:00
clocksource
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00
comedi
comedi: fix divide-by-zero in comedi_buf_munge()
2025-10-22 08:03:52 +02:00
connector
…
counter
…
cpufreq
cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate
2025-10-15 08:21:16 -05:00
cpuidle
Revert "cpuidle: menu: Avoid discarding useful information"
2025-10-20 21:27:16 +02:00
crypto
Merge tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2025-10-08 09:38:31 -07:00
cxl
cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events
2025-10-14 14:48:14 -07:00
dax
…
dca
…
devfreq
PM / devfreq: rockchip-dfi: switch to FIELD_PREP_WM16 macro
2025-10-15 10:39:54 -04:00
dibs
dibs: Check correct variable in dibs_init()
2025-09-26 15:10:59 -07:00
dio
…
dma
Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
2025-10-06 10:37:06 -07:00
dma-buf
…
dpll
dpll: zl3073x: Handle missing or corrupted flash configuration
2025-10-13 17:24:36 -07:00
edac
Merge tag 'edac_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras
2025-09-30 11:41:03 -07:00
eisa
…
extcon
…
firewire
firewire: init_ohci1394_dma: add missing function parameter documentation
2025-10-25 08:29:56 +09:00
firmware
Merge tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes
2025-10-23 22:30:01 +02:00
fpga
…
fsi
…
fwctl
pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc
2025-09-22 10:33:10 -03:00
gnss
…
gpio
gpio: ljca: Fix duplicated IRQ mapping
2025-10-23 14:30:11 +02:00
gpu
Merge tag 'drm-xe-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
2025-10-24 13:39:21 +02:00
greybus
…
hid
Merge tag 'hid-for-linus-2025101701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
2025-10-18 08:18:18 -10:00
hsi
…
hte
…
hv
Drivers: hv: Make CONFIG_HYPERV bool
2025-10-01 00:00:45 +00:00
hwmon
hwmon: (sht3x) Fix error handling
2025-10-19 18:56:14 -07:00
hwspinlock
…
hwtracing
Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-04 16:26:32 -07:00
i2c
i2c: usbio: Add ACPI device-id for MTL-CVF devices
2025-10-14 13:54:43 +02:00
i3c
i3c: fix big-endian FIFO transfers
2025-09-29 00:17:22 +02:00
idle
…
iio
Merge tag 'iio-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
2025-09-23 14:15:25 +02:00
infiniband
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
2025-10-03 18:35:22 -07:00
input
Merge tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2025-10-08 09:44:38 -07:00
interconnect
…
iommu
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
2025-10-03 18:18:48 -07:00
ipack
…
irqchip
irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
2025-10-07 10:23:22 +02:00
isdn
…
leds
leds: led-class: Add Device Tree support to led_get()
2025-09-16 16:49:28 +01:00
macintosh
…
mailbox
Merge tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox
2025-10-08 11:44:21 -07:00
mcb
…
md
Merge tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
2025-10-03 18:48:02 -07:00
media
Merge tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2025-10-04 16:07:08 -07:00
memory
…
memstick
Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-10-02 18:18:33 -07:00
message
…
mfd
mfd: ls2kbmc: check for devm_mfd_add_devices() failure
2025-10-03 10:38:23 -05:00
misc
Merge tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2025-10-26 10:33:46 -07:00
mmc
rpmb: move rpmb_frame struct and constants to common header
2025-10-13 13:18:03 +02:00
most
most: usb: hdm_probe: Fix calling put_device() before device initialization
2025-10-22 08:04:43 +02:00
mtd
Merge tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
2025-10-04 15:50:37 -07:00
mux
…
net
net/mlx5: Fix IPsec cleanup over MPV device
2025-10-23 07:14:33 -07:00
nfc
…
ntb
NTB: epf: Add Renesas rcar support
2025-09-22 09:35:21 -04:00
nubus
…
nvdimm
Merge tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2025-10-06 11:17:18 -07:00
nvme
nvme/tcp: handle tls partially sent records in write_space()
2025-10-16 11:32:04 -07:00
nvmem
nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE
2025-10-22 08:02:38 +02:00
of
of/irq: Export of_msi_xlate() for module usage
2025-10-24 07:44:09 -05:00
opp
…
parisc
…
parport
…
pci
Merge tag 'pci-v6.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2025-10-24 16:43:08 -07:00
pcmcia
…
peci
…
perf
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2025-10-07 08:59:25 -07:00
phy
Merge tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
2025-10-06 10:34:22 -07:00
pinctrl
Merge tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2025-10-06 10:41:03 -07:00
platform
platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530
2025-10-15 11:22:35 +03:00
pmdomain
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
pnp
…
power
Merge tag 'for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
2025-10-01 13:02:59 -07:00
powercap
…
pps
…
ps3
…
ptp
ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
2025-10-22 19:18:39 -07:00
pwm
Merge tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
2025-10-01 11:34:12 -07:00
rapidio
…
ras
…
regulator
Merge tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
2025-10-01 12:04:12 -07:00
remoteproc
Merge tag 'rproc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
2025-10-04 15:45:17 -07:00
reset
Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2025-10-01 17:32:51 -07:00
rpmsg
rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
2025-09-20 21:29:48 -05:00
rtc
Merge tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
2025-10-11 11:56:47 -07:00
s390
Merge tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2025-10-09 10:51:43 -07:00
sbus
…
scsi
Merge branch '6.18/scsi-queue' into 6.18/scsi-fixes
2025-10-13 15:54:13 -04:00
sh
…
siox
…
slimbus
…
soc
Merge tag 'mips_6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
2025-10-05 10:09:55 -07:00
soundwire
Merge tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
2025-10-06 10:32:22 -07:00
spi
spi: intel-pci: Add support for Intel Wildcat Lake SPI serial flash
2025-10-20 16:15:31 +01:00
spmi
…
ssb
…
staging
staging: gpib: Fix device reference leak in fmh_gpib driver
2025-10-13 10:55:03 +02:00
target
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2025-10-11 11:49:00 -07:00
tc
…
tee
Merge tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes
2025-10-17 15:26:52 +02:00
thermal
thermal: renesas: Fix RZ/G3E fall-out
2025-10-02 10:41:58 +02:00
thunderbolt
thunderbolt: Fix use-after-free in tb_dp_dprx_work
2025-09-23 17:16:38 +02:00
tty
serial: 8250_mtk: Enable baud clock and manage in runtime PM
2025-10-22 12:13:54 +02:00
ufs
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2025-10-11 11:49:00 -07:00
uio
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00
usb
Merge tag 'usb-serial-6.18-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
2025-10-24 13:52:58 +02:00
vdpa
vduse: Use fixed 4KB bounce pages for non-4KB page size
2025-10-01 07:24:55 -04:00
vfio
vfio: Dump migration features under debugfs
2025-10-06 11:22:48 -06:00
vhost
vdpa: support virtio_map
2025-10-01 07:24:43 -04:00
video
fbdev: bitblit: bound-check glyph index in bit_putcs*
2025-10-28 22:59:19 +01:00
virt
Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2025-09-29 18:48:39 -07:00
virtio
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2025-10-04 08:48:16 -07:00
w1
…
watchdog
Merge tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog
2025-10-06 11:00:30 -07:00
xen
Merge tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
2025-10-03 17:41:12 -07:00
zorro
…
Kconfig
…
Makefile
Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2025-10-07 08:40:15 -07:00