korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-16 08:44:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
4318608dc2
linux/drivers
History
Hagar Hemdan c65ab97efc gpio: prevent potential speculation leaks in gpio_device_get_desc() 
commit d795848ecc upstream.

Userspace may trigger a speculative read of an address outside the gpio
descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range.
Offset is copied from user and then used as an array index to get
the gpio descriptor without sanitization in gpio_device_get_desc().

This change ensures that the offset is sanitized by using
array_index_nospec() to mitigate any possibility of speculative
information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Link: https://lore.kernel.org/r/20240523085332.1801-1-hagarhem@amazon.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-10-17 15:10:41 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: processor: Fix memory leaks in error paths of processor_add() 2024-09-12 11:07:52 +02:00
amba
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:07:51 +02:00
ata ata: pata_macio: Use WARN instead of BUG 2024-09-12 11:07:50 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-09-04 13:23:18 +02:00
auxdisplay
base devres: Initialize an uninitialized struct member 2024-09-12 11:07:48 +02:00
bcma
block rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings 2024-08-19 05:45:22 +02:00
bluetooth Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO 2024-09-04 13:23:37 +02:00
bus bus: tegra-aconnect: Update dependency to ARCH_TEGRA 2024-03-26 18:21:19 -04:00
cdrom
char char: xillybus: Check USB endpoints when probing device 2024-09-04 13:23:15 +02:00
clk clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API 2024-09-12 11:07:44 +02:00
clocksource clocksource/drivers/timer-of: Remove percpu irq related code 2024-09-12 11:07:51 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:05:26 +02:00
connector
counter
cpufreq cpufreq: scmi: Avoid overflow of target_freq in fast switch 2024-09-12 11:07:41 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:01:43 +02:00
crypto crypto: hisilicon/sec - Fix memory leak for sec resource release 2024-07-05 09:14:24 +02:00
cxl
dax
dca
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-23 08:54:38 +01:00
dio
dma dmaengine: dw: Add memory bus width verification 2024-09-04 13:23:40 +02:00
dma-buf dma-buf: heaps: Fix off-by-one in CMA heap fault handler 2024-10-17 15:10:37 +02:00
edac EDAC, i10nm: make skx_common.o a separate module 2024-08-19 05:44:49 +02:00
eisa
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-16 13:39:39 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:51:01 +02:00
firmware firmware: turris-mox-rwtm: Initialize completion before mailbox 2024-08-19 05:44:55 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-16 13:39:38 +02:00
fsi
gnss
gpio gpio: prevent potential speculation leaks in gpio_device_get_desc() 2024-10-17 15:10:41 +02:00
gpu drm: komeda: Fix an issue related to normalized zpos 2024-10-17 15:10:39 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: multitouch: Add support for GT7868Q 2024-10-17 15:10:33 +02:00
hsi
hv Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:07:51 +02:00
hwmon hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2 2024-10-17 15:10:35 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-12 11:07:41 +02:00
hwtracing coresight: Fix ref leak when of_coresight_parse_endpoint() fails 2024-08-19 05:45:04 +02:00
i2c i2c: riic: avoid potential division by zero 2024-09-04 13:23:20 +02:00
i3c i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup 2024-09-12 11:07:49 +02:00
idle
iio iio: adc: ad7124: fix chip ID mismatch 2024-09-12 11:07:50 +02:00
infiniband RDMA/efa: Properly handle unexpected AQ completions 2024-09-12 11:07:41 +02:00
input Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table 2024-10-17 15:10:33 +02:00
interconnect Revert "interconnect: Teach lockdep about icc_bw_lock order" 2024-03-06 14:38:50 +00:00
iommu iommu/vt-d: Handle volatile descriptor status read 2024-09-12 11:07:48 +02:00
ipack
irqchip irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 2024-09-12 11:07:45 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-19 05:45:25 +02:00
leds leds: spi-byte: Call of_node_put() on error path 2024-09-12 11:07:46 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-19 05:45:06 +02:00
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-23 08:54:50 +01:00
mcb
md dm init: Handle minors larger than 255 2024-09-12 11:07:47 +02:00
media media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse 2024-09-12 11:07:46 +02:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-09-04 13:23:25 +02:00
memstick
message
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-19 05:45:03 +02:00
misc eeprom: digsy_mtc: Fix 93xx46 driver probe failure 2024-10-17 15:10:35 +02:00
mmc mmc: cqhci: Fix checking of CQHCI_HALT state 2024-09-12 11:07:43 +02:00
most
mtd ubi: eba: properly rollback inside self_check_eba 2024-08-19 05:45:16 +02:00
mux
net wifi: iwlwifi: clear trans->state earlier upon error 2024-10-17 15:10:39 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:23:40 +02:00
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:21:28 -04:00
nubus
nvdimm
nvme nvmet-tcp: fix kernel crash if commands allocation fails 2024-09-12 11:07:52 +02:00
nvmem nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc 2024-09-12 11:07:51 +02:00
of of/irq: Support #msi-cells=<0> in of_msi_get_domain 2024-10-17 15:10:30 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc
parport dev/parport: fix the array out-of-bounds risk 2024-08-19 05:45:16 +02:00
pci PCI: Add missing bridge lock to pci_bus_lock() 2024-09-12 11:07:49 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:07:46 +02:00
perf
phy phy: zynqmp: Enable reference clock correctly 2024-09-04 13:23:42 +02:00
pinctrl pinctrl: at91: make it work with current gpiolib 2024-10-17 15:10:38 +02:00
platform platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array 2024-10-17 15:10:34 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: axp288_charger: Round constant_charge_voltage writes down 2024-08-19 05:45:46 +02:00
powercap
pps
ps3
ptp ptp: fix integer overflow in max_vclocks_store 2024-07-05 09:14:31 +02:00
pwm pwm: stm32: Always do lazy disabling 2024-08-19 05:44:51 +02:00
rapidio
ras
regulator regulator: bd71815: fix ramp values 2024-07-05 09:14:33 +02:00
remoteproc remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init 2024-08-19 05:45:30 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-25 14:52:30 -08:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-02-23 08:54:24 +01:00
rtc rtc: isl1208: Fix return value of nvmem callbacks 2024-08-19 05:45:20 +02:00
s390 bitmap: introduce generic optimized bitmap_size() 2024-09-04 13:23:16 +02:00
sbus
scsi scsi: lpfc: Fix overflow build issue 2024-10-17 15:10:38 +02:00
sh
siox
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 11:51:04 +02:00
soc soc: qcom: cmd-db: Map shared memory as WC, not WB 2024-09-04 13:23:40 +02:00
soundwire soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-10-17 15:10:37 +02:00
spi spi: spidev: Add missing spi_device_id for jg10309-01 2024-10-17 15:10:40 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging minmax: reduce min/max macro expansion in atomisp driver 2024-10-17 15:10:34 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 11:50:54 +02:00
tc
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-10 16:18:46 +02:00
thermal thermal/drivers/qcom/lmh: Check for SCM availability at probe 2024-06-16 13:39:55 +02:00
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-09-04 13:23:15 +02:00
tty serial: core: check uartclk for zero to avoid divide by zero 2024-08-19 05:45:46 +02:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:07:51 +02:00
usb usb: dwc3: core: update LC timer as per USB Spec V3.2 2024-09-12 11:07:51 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:14:42 +02:00
vfio vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-10 16:19:30 +02:00
vhost vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler 2024-08-19 05:45:44 +02:00
video fbdev: savage: Handle err return when savagefb_check_var failed 2024-06-16 13:39:57 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-16 13:39:32 +02:00
virtio virtio: delete vq in vp_find_vqs_msix() when request_irq() fails 2024-06-16 13:39:47 +02:00
visorbus
vlynq
vme
w1
watchdog watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin 2024-06-16 13:39:59 +02:00
xen xen/events: close evtchn after mapping cleanup 2024-04-10 16:18:46 +02:00
zorro
Kconfig
Makefile