Ning Qiang 00acc945f5 macintosh/adb: fix oob read in do_adb_query() function ... commit fd97e4ad6d upstream. In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied form userland. The parameter "req->data[2]" is missing check, the array size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and adb_handler[req->data[2]].handler_id will lead to oob read. Cc: stable <stable@kernel.org> Signed-off-by: Ning Qiang <sohu0106@126.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-25 11:11:10 +02:00
..
accessibility
acpi	ACPI: video: Shortening quirk list by identifying Clevo by board_name only	2022-08-25 11:11:10 +02:00
amba
android	binder: fix async_free_space accounting for empty parcels	2022-01-05 12:33:49 +01:00
ata	ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()	2022-06-25 11:46:42 +02:00
atm	atm: eni: Add check for dma_map_single	2022-03-23 09:01:35 +01:00
auxdisplay	auxdisplay: ht16k33: Fix frame buffer device blanking	2021-11-26 11:40:35 +01:00
base	x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data	2022-06-16 13:01:55 +02:00
bcma
block	xen/blkfront: force data bouncing when backend is untrusted	2022-07-07 17:31:18 +02:00
bluetooth	Bluetooth: bfusb: fix division by zero in send path	2022-01-27 09:00:46 +01:00
bus	bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()	2022-05-12 12:17:07 +02:00
cdrom
char	Revert "Revert "char/random: silence a lockdep splat with printk()""	2022-07-29 17:06:50 +02:00
clk	clk: at91: generated: consider range when calculating best rate	2022-05-25 08:41:20 +02:00
clocksource	clocksource/drivers/sp804: Avoid error on multiple instances	2022-06-14 16:54:00 +02:00
connector
cpufreq	cpufreq: pmac32-cpufreq: Fix refcount leak bug	2022-07-21 20:42:46 +02:00
cpuidle	cpuidle: Fix kobject memory leaks in error paths	2021-11-26 11:40:29 +01:00
crypto	crypto: ccp - ccp_dmaengine_unregister release dma channels	2022-04-20 09:08:13 +02:00
dax
dca
devfreq
dio
dma	dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate	2022-07-12 16:27:29 +02:00
dma-buf
edac	EDAC: Fix calculation of returned address and next offset in edac_align_ptr()	2022-02-23 11:57:35 +01:00
eisa
extcon	extcon: Modify extcon device to be created after driver data is set	2022-06-14 16:54:00 +02:00
firewire	firewire: core: extend card->lock in fw_core_handle_bus_reset	2022-05-12 12:17:09 +02:00
firmware	firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle	2022-06-14 16:53:57 +02:00
fmc
fpga
fsi
gpio	MIPS: Remove repetitive increase irq_err_count	2022-07-02 16:18:08 +02:00
gpu	tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator	2022-07-29 17:06:51 +02:00
hid	HID: hid-led: fix maximum brightness for Dream Cheeky	2022-06-14 16:53:48 +02:00
hsi	HSI: core: Fix return freed object in hsi_new_client	2022-01-27 09:00:54 +01:00
hv	random: remove unused irq_flags argument from add_interrupt_randomness()	2022-06-25 11:46:30 +02:00
hwmon	hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails	2022-07-07 17:31:17 +02:00
hwspinlock
hwtracing	coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier	2022-06-14 16:53:56 +02:00
i2c	i2c: cadence: Change large transfer count reset logic to be unconditional	2022-07-29 17:06:50 +02:00
ide
idle
iio	iio: adc: axp288: Override TS pin bias current for some models	2022-07-02 16:18:09 +02:00
infiniband	RDMA/qedr: Fix reporting QP timeout attribute	2022-07-07 17:31:16 +02:00
input	Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag	2022-06-14 16:54:02 +02:00
iommu	iommu/vt-d: Fix PCI bus rescan device hot add	2022-07-12 16:27:28 +02:00
ipack
irqchip	irqchip: or1k-pic: Undefine mask_ack for level triggered hardware	2022-07-21 20:42:47 +02:00
isdn	mISDN: change function names to avoid conflicts	2022-01-11 13:57:38 +01:00
leds
lightnvm	lightnvm: disable the subsystem	2022-05-12 12:17:04 +02:00
macintosh	macintosh/adb: fix oob read in do_adb_query() function	2022-08-25 11:11:10 +02:00
mailbox	mailbox: forward the hrtimer if not queued and under a lock	2022-06-14 16:53:51 +02:00
mcb
md	dm raid: fix KASAN warning in raid5_add_disks	2022-07-07 17:31:16 +02:00
media	media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init	2022-06-14 16:53:49 +02:00
memory	memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe	2022-04-20 09:08:31 +02:00
memstick	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()	2021-11-26 11:40:30 +01:00
message
mfd	misc: rtsx: set NULL intfdata when probe fails	2022-06-14 16:54:00 +02:00
misc	misc: atmel-ssc: Fix IRQ check in ssc_probe	2022-06-25 11:46:44 +02:00
mmc	mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()	2022-05-25 08:41:19 +02:00
mtd	mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N	2022-06-14 16:54:02 +02:00
mux
net	mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.	2022-08-25 11:11:10 +02:00
nfc	NFC: nxp-nci: don't print header length mismatch on i2c error	2022-07-21 20:42:46 +02:00
ntb
nubus
nvdimm	nvdimm: Fix badblocks clear off-by-one error	2022-07-07 17:31:16 +02:00
nvme	nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags	2022-06-14 16:53:45 +02:00
nvmem
of	fdt: Update CRC check for rng-seed	2022-07-02 16:18:10 +02:00
oprofile
parisc	parisc: Fix CPU affinity for Lasi, WAX and Dino chips	2022-04-20 09:08:28 +02:00
parport
pci	PCI: hv: Fix interrupt mapping for multi-MSI	2022-07-29 17:06:53 +02:00
pcmcia	pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards	2022-06-14 16:53:55 +02:00
perf	perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator	2022-04-20 09:08:30 +02:00
phy	phy: qcom-qmp: fix reset-controller leak on probe errors	2022-06-14 16:53:55 +02:00
pinctrl	pinctrl: sunxi: a83t: Fix NAND function name for some pins	2022-07-12 16:27:29 +02:00
platform	platform/x86: hp-wmi: Ignore Sanitization Mode event	2022-07-21 20:42:46 +02:00
pnp
power	power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe	2022-07-29 17:06:49 +02:00
powercap
pps
ps3
ptp	ptp: replace snprintf with sysfs_emit	2022-04-20 09:08:26 +02:00
pwm	pwm: lp3943: Fix duty calculation in case period was clamped	2022-06-14 16:53:56 +02:00
rapidio
ras
regulator	regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt	2022-06-14 16:53:49 +02:00
remoteproc	remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region	2022-04-20 09:08:19 +02:00
reset
rpmsg	rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value	2022-06-14 16:53:56 +02:00
rtc	rtc: mt6397: check return value after calling platform_get_resource()	2022-06-14 16:53:56 +02:00
s390	tty: the rest, stop using tty_schedule_flip()	2022-07-29 17:06:52 +02:00
sbus
scsi	scsi: ufs: host: Hold reference returned by of_parse_phandle()	2022-08-25 11:11:09 +02:00
sfi
sh	maple: fix wrong return value of maple_bus_init().	2021-11-26 11:40:39 +01:00
sn
soc	soc: rockchip: Fix refcount leak in rockchip_grf_init	2022-06-14 16:53:56 +02:00
spi	spi: img-spfi: Fix pm_runtime_get_sync() error checking	2022-06-14 16:53:48 +02:00
spmi
ssb
staging	tty: the rest, stop using tty_schedule_flip()	2022-07-29 17:06:52 +02:00
target	scsi: target: tcmu: Fix possible page UAF	2022-04-20 09:08:32 +02:00
tc
tee	tee: handle lookup of shm with reference count 0	2022-01-05 12:33:48 +01:00
thermal	thermal: int340x: Increase bitmap size	2022-04-20 09:08:12 +02:00
thunderbolt
tty	tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()	2022-07-29 17:06:53 +02:00
uio
usb	usb: dwc3: gadget: Fix event pending check	2022-07-21 20:42:47 +02:00
uwb
vfio
vhost	vringh: Fix loop descriptors check in the indirect cases	2022-06-14 16:54:01 +02:00
video	fbcon: Disallow setting font bigger than screen size	2022-07-12 16:27:28 +02:00
virt
virtio	virtio_mmio: Restore guest page size on resume	2022-07-21 20:42:46 +02:00
vlynq
vme
w1	w1: w1_therm: fixes w1_seq for ds28ea00 sensors	2022-04-20 09:08:28 +02:00
watchdog	ar7: fix kernel builds for compiler test	2021-11-26 11:40:35 +01:00
xen	xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE	2022-07-29 17:06:49 +02:00
zorro
Kconfig
Makefile