mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 11:21:26 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
c088d5dd2fffb4de1fb8e7f57751c8b82942180a
linux/drivers
History
Greg Kroah-Hartman c088d5dd2f usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() 
A broken/bored/mean USB host can overflow the skb_shared_info->frags[]
array on a Linux gadget exposing a Phonet function by sending an
unbounded sequence of full-page OUT transfers.

pn_rx_complete() finalizes the skb only when req->actual < req->length,
where req->length is set to PAGE_SIZE by the gadget.  If the host always
sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be
reset and each completion will add another fragment via
skb_add_rx_frag().  Once nr_frags exceeds MAX_SKB_FRAGS (default 17),
subsequent frag stores overwrite memory adjacent to the shinfo on the
heap.

Drop the skb and account a length error when the frag limit is reached,
matching the fix applied in t7xx by commit f0813bcd2d ("net: wwan:
t7xx: fix potential skb->frags overflow in RX path").

Cc: stable <stable@kernel.org>
Assisted-by: gregkh_clanker_t1000
Link: https://patch.msgid.link/2026040705-fruit-unloved-0701@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-07 13:50:34 +02:00
..
accel
accel/qaic: Handle DBC deactivation if the owner went away
2026-03-27 10:48:30 -06:00
accessibility
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
acpi
Merge tag 'riscv-for-linus-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
2026-04-05 14:43:47 -07:00
amba
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
android
rust_binder: use AssertSync for BINDER_VM_OPS
2026-03-31 14:58:56 +02:00
ata
ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
2026-03-20 09:59:30 +01:00
atm
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
auxdisplay
auxdisplay: line-display: fix NULL dereference in linedisp_release
2026-03-27 09:54:31 +01:00
base
Merge tag 'regmap-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
2026-03-27 16:34:25 -07:00
bcma
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
block
zram: do not slot_free() written-back slots
2026-03-21 17:36:33 -07:00
bluetooth
Bluetooth: hci_h4: Fix race during initialization
2026-04-01 16:45:47 -04:00
bus
driver core: platform: use generic driver_override infrastructure
2026-03-17 20:30:57 +01:00
cache
cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
2026-02-06 19:54:40 +00:00
cdrom
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
cdx
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
char
Merge tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi
2026-02-26 14:34:21 -08:00
clk
driver core: platform: use generic driver_override infrastructure
2026-03-17 20:30:57 +01:00
clocksource
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
comedi
comedi: dt2815: add hardware detection to prevent crash
2026-04-02 14:40:27 +02:00
connector
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
counter
counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
2026-03-22 15:59:22 +09:00
cpufreq
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
2026-04-01 16:08:15 +02:00
cpuidle
sched: idle: Make skipping governor callbacks more consistent
2026-03-10 16:03:02 +01:00
crypto
Merge tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2026-04-02 17:29:48 -07:00
cxl
cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi
2026-03-19 15:12:40 -07:00
dax
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dca
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
devfreq
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
dibs
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dio
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dma
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
2026-03-17 16:33:32 +05:30
dma-buf
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
dpll
Merge tag 'net-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-02-26 08:00:13 -08:00
edac
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
eisa
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
extcon
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
firewire
bonding: prevent potential infinite loop in bond_header_parse()
2026-03-16 19:29:45 -07:00
firmware
Merge tag 'soc-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2026-03-18 08:28:54 -07:00
fpga
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
fsi
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
fwctl
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
gnss
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
gpib
gpib: fix use-after-free in IO ioctl handlers
2026-04-02 14:30:40 +02:00
gpio
gpio: shared: shorten the critical section in gpiochip_setup_shared()
2026-03-30 09:51:15 +02:00
gpu
i915: don't use a vma that didn't match the context VM
2026-04-05 12:42:25 -07:00
greybus
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
hid
Merge tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
2026-03-17 13:55:51 -07:00
hsi
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
hte
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
hv
mshv: Fix error handling in mshv_region_pin
2026-03-18 16:18:49 +00:00
hwmon
hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
2026-04-01 07:45:57 -07:00
hwspinlock
Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2026-02-10 20:45:30 -08:00
hwtracing
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
i2c
i2c: designware: amdisp: Fix resume-probe race condition issue
2026-03-27 13:51:21 +01:00
i3c
i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
2026-03-11 22:50:29 +01:00
idle
intel_idle: Add C-states validation
2026-01-07 21:17:43 +01:00
iio
Merge tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus
2026-03-29 15:27:12 +02:00
infiniband
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
2026-03-27 13:30:04 -07:00
input
Merge tag 'input-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2026-04-04 08:24:32 -07:00
interconnect
interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()
2026-03-14 12:53:13 +02:00
iommu
Merge tag 'iommu-fixes-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
2026-04-02 09:53:16 -07:00
ipack
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
irqchip
irqchip/riscv-aplic: Restrict genpd notifier to device tree only
2026-03-31 10:11:29 +02:00
isdn
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
leds
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
macintosh
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
mailbox
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
mcb
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
md
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
media
media: ccs: Avoid deadlock in ccs_init_state()
2026-03-26 13:14:07 +01:00
memory
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
memstick
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
message
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
mfd
mfd: max77759: add register bitmasks and modify irq configs for charger
2026-03-30 16:58:33 +02:00
misc
misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
2026-04-02 14:42:19 +02:00
mmc
mmc: sdhci: fix timing selection for 1-bit bus width
2026-03-16 16:08:54 +01:00
most
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
mtd
mtd: rawnand: pl353: make sure optimal timings are applied
2026-03-18 18:08:25 +01:00
mux
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
net
eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
2026-04-02 08:38:34 -07:00
nfc
NFC: pn533: bound the UART receive buffer
2026-03-31 11:04:30 +02:00
ntb
Merge tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
2026-02-21 11:02:58 -08:00
nubus
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
nvdimm
nvdimm/bus: Fix potential use after free in asynchronous initialization
2026-03-09 09:38:22 -05:00
nvme
Merge tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2026-03-13 10:13:06 -07:00
nvmem
nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
2026-04-02 16:44:40 +02:00
of
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
opp
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
parisc
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
parport
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pci
PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak
2026-03-23 15:57:43 -05:00
pcmcia
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
peci
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
perf
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
phy
phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
2026-02-27 20:46:57 +05:30
pinctrl
pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown
2026-03-23 14:23:09 +01:00
platform
platform/x86: ISST: Correct locked bit width
2026-03-24 12:31:10 +02:00
pmdomain
Merge tag 'pmdomain-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
2026-03-20 09:46:15 -07:00
pnp
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
power
power: supply: max77759: add charger driver
2026-03-30 16:58:33 +02:00
powercap
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
pps
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ps3
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ptp
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pwm
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
rapidio
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ras
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
regulator
regulator: pca9450: Correct probed name for PCA9452
2026-03-10 14:52:42 +00:00
remoteproc
remoteproc: imx_rproc: Fix unreachable platform prepare_ops
2026-03-05 10:18:23 -07:00
resctrl
arm_mpam: Force __iomem casts
2026-03-13 14:17:30 +00:00
reset
reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it
2026-02-23 17:03:28 +01:00
rpmsg
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
rtc
Merge tag 'rtc-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
2026-02-22 09:43:11 -08:00
s390
Merge tag 's390-7.0-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2026-04-03 17:50:24 -07:00
sbus
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
scsi
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2026-03-27 19:58:22 -07:00
sh
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
siox
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
slimbus
driver core: platform: use generic driver_override infrastructure
2026-03-17 20:30:57 +01:00
soc
Merge tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes
2026-03-17 09:35:40 +01:00
soundwire
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
spi
spi: cadence-qspi: Fix exec_mem_op error handling
2026-03-30 21:34:53 +01:00
spmi
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ssb
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
staging
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
2026-02-24 10:01:20 -08:00
target
scsi: target: file: Use kzalloc_flex for aio_cmd
2026-03-19 22:07:39 -04:00
tc
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
tee
tee: shm: Remove refcounting of kernel pages
2026-03-03 09:03:04 +01:00
thermal
thermal: core: Fix thermal zone device registration error path
2026-04-02 11:37:35 +02:00
thunderbolt
thunderbolt: Fix property read in nhi_wake_supported()
2026-03-09 12:36:54 +01:00
tty
vt: resize saved unicode buffer on alt screen exit after resize
2026-03-30 17:39:44 +02:00
ufs
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
2026-03-07 11:08:39 -05:00
uio
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
usb
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
2026-04-07 13:50:34 +02:00
vdpa
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
vfio
vfio/pci: Fix double free in dma-buf feature
2026-03-26 06:38:27 -06:00
vhost
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
video
fbdev: au1100fb: Fix build on MIPS64
2026-03-05 17:35:12 +01:00
virt
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
2026-03-20 21:05:50 -07:00
virtio
dma-mapping: Clarify valid conditions for CPU cache line overlap
2026-03-20 11:33:24 +01:00
w1
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
watchdog
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
xen
xen/privcmd: unregister xenstore notifier on module exit
2026-03-26 08:57:51 +01:00
zorro
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
Kconfig
…
Makefile
phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY
2026-02-04 20:45:26 +05:30