Larry Finger 499c405b2b staging: rtl8188eu: Fix potential security hole ... In routine rtw_hostapd_ioctl(), the user-controlled p->length is assumed to be at least the size of struct ieee_param size, but this assumption is never checked. This could result in out-of-bounds read/write on kernel heap in case a p->length less than the size of struct ieee_param is specified by the user. If p->length is allowed to be greater than the size of the struct, then a malicious user could be wasting kernel memory. Fixes commit a2c60d42d9 ("Add files for new driver - part 16"). Reported by: Pietro Oliva <pietroliva@gmail.com> Cc: Pietro Oliva <pietroliva@gmail.com> Cc: Stable <stable@vger.kernel.org> Fixes: a2c60d42d9 ("staging: r8188eu: Add files for new driver - part 16") Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Link: https://lore.kernel.org/r/20200210180235.21691-2-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-10 10:32:31 -08:00
..
android	staging: android: Delete the 'vsoc' driver	2020-02-10 08:51:12 -08:00
axis-fifo	staging: axis-fifo: replace spinlock with mutex	2020-01-22 09:58:01 +01:00
board
clocking-wizard	staging: clocking-wizard: use devm_platform_ioremap_resource() to simplify code	2019-10-10 11:00:59 +02:00
comedi	staging: comedi: drivers: fix spelling mistake "to" -> "too"	2020-01-23 19:16:13 +01:00
emxx_udc	staging: emxx_udc: Fix invalid reference error	2019-10-30 10:38:46 +01:00
exfat	staging: exfat: remove fs_func struct.	2020-01-23 19:16:13 +01:00
fbtft	fbtft: Fix the initialization from property algorithm	2019-12-10 15:55:55 +01:00
fieldbus	staging: fieldbus: anybuss: use devm_platform_ioremap_resource helper	2019-10-27 08:15:43 +01:00
fsl-dpaa2	staging: dpaa2-ethsw: ordered workqueue should be per ethsw	2019-11-13 00:10:16 +01:00
fwserial	staging: fwserial: Fix Kconfig indentation (seven spaces)	2019-11-22 11:32:54 +01:00
gasket	remove ioremap_nocache and devm_ioremap_nocache	2020-01-06 09:45:59 +01:00
gdm724x
goldfish
greybus	staging: greybus: use after free in gb_audio_manager_remove_all()	2020-02-10 08:52:33 -08:00
gs_fpgaboot
hp	Merge 5.5-rc2 into staging-next	2019-12-16 09:06:50 +01:00
iio	iio: adis: Remove startup_delay	2020-01-12 11:34:13 +00:00
kpc2000	Staging/IIO patches for 5.6-rc1	2020-01-29 10:15:11 -08:00
ks7010	netdev: pass the stuck queue to the timeout handler	2019-12-12 21:38:57 -08:00
media	media updates for v5.6-rc1	2020-01-31 14:43:23 -08:00
most	staging: most: usb: check for NULL device	2020-01-24 10:08:41 +01:00
mt7621-dma	staging: mt7621-dma: align to match open parenthesis	2019-11-07 16:14:10 +01:00
mt7621-dts	staging: mt7621-dts: fix register range of memc node in mt7621.dtsi	2020-01-10 13:49:18 +01:00
mt7621-pci	MIPS: ralink: enable PCI support only if driver for mt7621 SoC is selected	2019-11-14 13:09:37 +08:00
mt7621-pci-phy
mt7621-pinctrl
netlogic	Staging: Netlogic: Fix spelling mistake	2019-10-24 23:08:32 -04:00
nvec	staging: nvec: check return value	2019-12-19 19:23:29 +01:00
olpc_dcon
pi433	compat_ioctl: remove most of fs/compat_ioctl.c	2019-12-01 13:46:15 -08:00
qlge	Staging/IIO patches for 5.6-rc1	2020-01-29 10:15:11 -08:00
ralink-gdma	staging: ralink-gdma: use devm_platform_ioremap_resource() to simplify code	2019-10-24 22:40:38 -04:00
rtl8188eu	staging: rtl8188eu: Fix potential security hole	2020-02-10 10:32:31 -08:00
rtl8192e	Staging/IIO patches for 5.6-rc1	2020-01-29 10:15:11 -08:00
rtl8192u	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
rtl8712	staging: rtl8712: simplify evm_db2percentage()	2020-01-22 09:44:45 +01:00
rtl8723bs	staging: rtl8723bs: fix copy of overlapping memory	2020-02-10 08:49:11 -08:00
rts5208	Staging/IIO patches for 5.6-rc1	2020-01-29 10:15:11 -08:00
sm750fb	remove ioremap_nocache and devm_ioremap_nocache	2020-01-06 09:45:59 +01:00
speakup
unisys	netdev: pass the stuck queue to the timeout handler	2019-12-12 21:38:57 -08:00
uwb	remove ioremap_nocache and devm_ioremap_nocache	2020-01-06 09:45:59 +01:00
vc04_services	staging: vc04_services: remove header include path to vc04_services	2020-01-10 17:33:41 +01:00
vme	compat_ioctl: move more drivers to compat_ptr_ioctl	2019-10-23 17:23:44 +02:00
vt6655	staging: vt6655: remove redundant assignment to variable ret	2020-01-15 13:11:41 +01:00
vt6656	staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.	2020-02-10 08:49:10 -08:00
wfx	staging: wfx: update TODO	2020-01-16 20:59:54 +01:00
wilc1000	staging: wilc1000: avoid mutex unlock without lock in wilc_wlan_handle_txq()	2020-01-23 19:16:12 +01:00
wlan-ng	Staging/IIO patches for 5.6-rc1	2020-01-29 10:15:11 -08:00
wusbcore
Kconfig	staging: octeon-usb: delete the octeon usb host controller driver	2019-12-17 12:54:55 +01:00
Makefile	staging: exfat: add STAGING prefix to config names	2020-01-03 11:04:58 +01:00