mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 04:03:23 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
220190f97da558e67cd01c62f1b84fe77b267a5a
linux/drivers
History
Linmao Li 220190f97d misc: issei: check bus message length before reading the command 
__issei_ham_process_ham_rsp() dispatches on hdr->cmd before the message
length is validated. The length comes from the firmware-owned DMA header
read in issei_dma_read(), which only bounds it from above, so firmware
sending a short bus message reaches the dispatch with less than
sizeof(struct ham_bus_message) bytes available.

For a zero-length message kmemdup() returns ZERO_SIZE_PTR, which passes
the NULL check in issei_dma_read(), and the dispatch dereferences it. A
length of one to three bytes gives a slab out-of-bounds read instead.

Reject bus messages shorter than the header before touching it, the way
the individual response handlers already validate their own length.

Fixes: 7bd4b9991d ("issei: implement main thread and ham messages")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260731025952.3505287-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:27:46 +02:00
..
accel
accel: ethosu: Handle U85 internal chaining buffer
2026-07-21 15:21:56 -05:00
accessibility
accessibility: speakup: unregister tty ldisc on later init failures
2026-07-17 14:54:56 +02:00
acpi
Merge tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2026-07-03 15:13:50 -10:00
amba
…
android
rust_binder: update indentation of failed transaction print
2026-07-31 14:15:54 +02:00
ata
Merge tag 'ata-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
2026-07-17 17:58:57 -07:00
atm
atm: remove unused ATM PHY operations
2026-06-16 08:53:53 -07:00
auxdisplay
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
base
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
2026-07-17 15:53:15 +02:00
bcma
…
block
Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2026-07-24 20:02:58 -07:00
bluetooth
Bluetooth: btusb: validate Realtek vendor event length
2026-07-20 17:41:28 -04:00
bus
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
cache
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
cdrom
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
2026-07-20 21:54:52 -06:00
cdx
cdx: Fix double free when sysfs file creation fails
2026-07-31 14:21:20 +02:00
char
virtio_console: fix race between hvc put_chars and virtqueue teardown on freeze
2026-07-31 14:20:02 +02:00
clk
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
clocksource
Merge tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
2026-06-15 13:57:13 +05:30
comedi
Merge 7.2-rc5 into char-misc-next
2026-07-27 14:17:19 +02:00
connector
…
counter
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
cpufreq
cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
2026-07-09 20:31:57 +02:00
cpuidle
cpuidle: Allow exit latency to exceed target residency
2026-06-23 14:00:29 +02:00
crypto
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
cxl
Merge branch 'for-7.2/cxl-type2-attach-region' into cxl-for-next
2026-06-12 13:47:53 -07:00
dax
Merge tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-19 10:14:34 -07:00
dca
…
devfreq
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
dibs
dibs: loopback: validate offset and size in move_data()
2026-07-09 12:44:00 +02:00
dio
…
dma
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
dma-buf
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
2026-07-10 16:26:39 -07:00
dpll
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
2026-07-17 12:02:23 +02:00
edac
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
eisa
EISA: Use str_plural() in eisa_probe()
2026-07-31 14:21:14 +02:00
extcon
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
firewire
firewire: net: Fix fragmented datagram reassembly
2026-07-13 20:19:06 +09:00
firmware
Merge tag 'svc_updates_for_v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-next
2026-07-31 14:14:51 +02:00
fpga
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
fsi
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
fwctl
…
gnss
…
gpib
gpib: Improve style of pnp_device_id array terminators
2026-07-17 14:54:14 +02:00
gpio
gpio: mvebu: free generic chips on unbind
2026-07-08 14:05:11 +02:00
gpu
drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
2026-07-24 09:30:17 -05:00
greybus
greybus: manifest: validate string descriptor header
2026-07-17 16:14:10 +02:00
hid
Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-07-12 12:37:28 -07:00
hsi
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
hte
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
hv
Merge tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
2026-06-22 08:06:13 -07:00
hwmon
Merge tag 'svc_updates_for_v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-next
2026-07-31 14:14:51 +02:00
hwspinlock
hwspinlock: qcom: avoid uninitialized struct members
2026-06-08 21:51:12 -05:00
hwtracing
intel_th: fix MSC output device reference leak
2026-07-17 14:52:08 +02:00
i2c
i2c: mediatek: fix WRRD for SoCs without auto_restart option
2026-07-15 00:21:51 +02:00
i3c
i3c: mipi-i3c-hci: Use named initializers for platform_device_id's .driver_data
2026-06-16 23:19:45 +02:00
idle
Merge tag 'x86-msr-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
2026-06-15 15:08:14 +05:30
iio
Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-07-12 12:37:28 -07:00
infiniband
bnge/bng_re: fix ring ID widths
2026-07-23 10:24:12 -07:00
input
Merge tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2026-07-11 15:42:55 -07:00
interconnect
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
iommu
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
2026-07-21 11:34:51 +00:00
ipack
ipack: ipoctal: add rwsem to guard against TOCTOU in remove path
2026-07-17 16:05:02 +02:00
irqchip
Merge tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-07-05 05:29:41 -10:00
leds
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
macintosh
…
mailbox
mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
2026-07-17 16:14:16 +02:00
mcb
…
md
dm thin metadata: fix superblock refcount leak on snapshot shadow failure
2026-07-11 15:18:51 +02:00
media
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
memory
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
memstick
memstick: ms_block: reject a card that reports too many blocks
2026-07-06 17:09:30 +02:00
message
…
mfd
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
misc
misc: issei: check bus message length before reading the command
2026-07-31 14:27:46 +02:00
mmc
mmc: sdhci-esdhc-imx: fix resume error handling
2026-07-15 11:00:02 +02:00
most
…
mtd
Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
2026-07-17 09:30:17 -07:00
mux
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
net
bnge/bng_re: fix ring ID widths
2026-07-23 10:24:12 -07:00
nfc
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
ntb
Merge tag 'ntb-7.2' of https://github.com/jonmason/ntb
2026-06-28 07:46:12 -07:00
nubus
…
nvdimm
Merge tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2026-06-18 16:27:58 -07:00
nvme
Merge tag 'block-7.2-20260625' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2026-06-25 09:56:47 -07:00
nvmem
nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data
2026-07-31 14:15:54 +02:00
of
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
opp
…
parisc
…
parport
parport: Consistently define pci_device_ids using named initializers
2026-07-17 14:54:18 +02:00
pci
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
pcmcia
…
peci
…
perf
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
phy
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
pinctrl
Merge tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
2026-07-03 05:38:12 -10:00
platform
Merge tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
2026-07-25 08:10:13 -07:00
pmdomain
pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
2026-07-13 12:42:17 +02:00
pnp
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
power
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
powercap
…
pps
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
ps3
…
ptp
ptp: netc: explicitly clear TMR_OFF during initialization
2026-07-23 09:16:14 -07:00
pwm
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
rapidio
Merge tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-21 13:20:19 -07:00
ras
Merge tag 'edac_updates_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/ras/ras
2026-06-16 05:31:01 +05:30
regulator
regulator: core: clamp voltage constraints before applying apply_uV
2026-07-21 22:35:08 +01:00
remoteproc
remoteproc: qcom: pas: Drop start/stop completion from struct qcom_pas
2026-06-08 21:53:51 -05:00
resctrl
arm_mpam: guard MBWU state before adding it to garbage
2026-07-16 14:46:27 +01:00
reset
Merge tag 'reset-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/pza/linux into arm/fixes
2026-07-10 14:15:39 +02:00
rpmsg
Merge tag 'rpmsg-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
2026-06-20 23:31:15 -07:00
rtc
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
s390
s390/zcrypt: Remove the empty file
2026-07-08 17:02:47 +02:00
sbus
…
scsi
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
2026-07-12 22:21:22 -04:00
sh
…
siox
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
slimbus
slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
2026-06-05 17:19:51 +02:00
soc
Merge tag 'tegra-for-7.2-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes
2026-07-10 14:42:00 +02:00
soundwire
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
spi
spi: spacemit: Correct TX FIFO slot calculation
2026-07-19 22:12:52 +01:00
spmi
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
ssb
…
staging
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
2026-07-17 14:23:13 +02:00
target
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
2026-07-12 22:21:22 -04:00
tc
…
tee
Merge tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2026-06-17 11:21:40 -07:00
thermal
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
thunderbolt
Merge tag 'usb-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2026-06-22 12:09:47 -07:00
tty
serial: sc16is7xx: implement gpio get_direction() callback
2026-07-17 13:07:32 +02:00
ufs
scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()
2026-07-08 21:51:36 -04:00
uio
uio: fsl_elbc_gpcm: use platform helpers for resource and IRQ
2026-07-31 14:21:01 +02:00
usb
Merge tag 'usb-serial-7.2-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
2026-07-24 15:36:52 +02:00
vdpa
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
vfio
vfio/pci: Expose latched module parameter policy in debugfs
2026-06-29 14:26:31 -06:00
vhost
vhost-net: fix TX stall when vhost owns virtio-net header
2026-07-21 13:25:34 +02:00
video
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
virt
drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
2026-07-17 18:49:12 +01:00
virtio
mm: page_reporting: allow driver to set batch capacity
2026-07-09 15:48:56 -07:00
w1
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
watchdog
Merge tag 'watchdog-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
2026-07-22 11:15:49 -07:00
xen
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2026-07-18 12:36:19 -07:00
zorro
…
Kconfig
…
Makefile
…