mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-10 18:53:38 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers
History
Myungho Jung 4e0ca4bfa2 Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() 
commit 1dc2d78515 upstream.

h4_recv_buf() callers store the return value to socket buffer and
recursively pass the buffer to h4_recv_buf() without protection. So,
ERR_PTR returned from h4_recv_buf() can be dereferenced, if called again
before setting the socket buffer to NULL from previous error. Check if
skb is ERR_PTR in h4_recv_buf().

Reported-by: syzbot+017a32f149406df32703@syzkaller.appspotmail.com
Signed-off-by: Myungho Jung <mhjungk@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-27 14:14:41 +09:00
..
accessibility
acpi ACPI / device_sysfs: Avoid OF modalias creation for removed device 2019-03-23 20:09:57 +01:00
amba
android binder: fix race that allows malicious free of live buffer 2018-12-05 19:32:11 +01:00
ata libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD 2019-02-15 08:10:10 +01:00
atm atm: he: fix sign-extension overflow on large shift 2019-02-27 10:08:57 +01:00
auxdisplay auxdisplay: ht16k33: fix potential user-after-free on module unload 2019-03-23 20:09:47 +01:00
base PM / wakeup: Rework wakeup source timer cancellation 2019-03-23 20:10:10 +01:00
bcma
block floppy: check_events callback should not return a negative number 2019-03-23 20:09:45 +01:00
bluetooth Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() 2019-03-27 14:14:41 +09:00
bus
cdrom gdrom: fix a memory leak bug 2019-02-12 19:47:18 +01:00
char tpm: Unify the send callback behaviour 2019-03-23 20:10:11 +01:00
clk clk: ingenic: Fix doc of ingenic_cgu_div_info 2019-03-23 20:10:03 +01:00
clocksource clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer instability 2019-03-23 20:09:58 +01:00
connector connector: fix unsafe usage of ->real_parent 2019-03-19 13:12:38 +01:00
cpufreq cpufreq: pxa2xx: remove incorrect __init annotation 2019-03-23 20:10:01 +01:00
cpuidle cpuidle: big.LITTLE: fix refcount leak 2019-02-12 19:47:08 +01:00
crypto crypto: rockchip - update new iv to device in multiple operations 2019-03-23 20:09:41 +01:00
dax mm, devm_memremap_pages: fix shutdown handling 2019-01-13 09:51:04 +01:00
dca
devfreq
dio
dma dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit 2019-03-23 20:10:04 +01:00
dma-buf
edac EDAC, skx_edac: Fix logical channel intermediate decoding 2018-11-13 11:08:44 -08:00
eisa
extcon
firewire
firmware iscsi_ibft: Fix missing break in switch statement 2019-03-13 14:02:39 -07:00
fmc
fpga fpga: altera-cvp: fix 'bad IO access' on x86_64 2019-02-12 19:46:59 +01:00
fsi fsi: master-ast-cf: select GENERIC_ALLOCATOR 2018-12-17 09:24:35 +01:00
gnss gnss: sirf: fix premature wakeup interrupt enable 2019-03-10 07:17:21 +01:00
gpio gpio: pca953x: Fix dereference of irq data in shutdown 2019-03-23 20:10:05 +01:00
gpu drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's 2019-03-27 14:14:38 +09:00
hid HID: debug: fix the ring buffer implementation 2019-02-12 19:47:24 +01:00
hsi
hv Drivers: hv: vmbus: Check for ring when getting debug info 2019-01-31 08:14:36 +01:00
hwmon hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table 2019-02-27 10:08:57 +01:00
hwspinlock
hwtracing intel_th: Don't reference unassigned outputs 2019-03-23 20:10:05 +01:00
i2c i2c: tegra: fix maximum transfer size 2019-03-23 20:10:05 +01:00
ide ide: fix a typo in the settings proc file name 2019-01-31 08:14:42 +01:00
idle
iio iio: adc: exynos-adc: Fix NULL pointer exception on unbind 2019-03-23 20:09:39 +01:00
infiniband IB/hfi1: Close race condition on user context disable and close 2019-03-23 20:10:02 +01:00
input Input: st-keyscan - fix potential zalloc NULL dereference 2019-03-23 20:09:47 +01:00
iommu iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE 2019-03-27 14:14:38 +09:00
ipack
irqchip irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp 2019-03-27 14:14:40 +09:00
isdn isdn: avm: Fix string plus integer warning from Clang 2019-02-27 10:08:58 +01:00
leds leds: lp5523: fix a missing check of return value of lp55xx_read 2019-02-27 10:08:57 +01:00
lightnvm lightnvm: pblk: add lock protection to list operations 2019-02-12 19:47:08 +01:00
macintosh
mailbox mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue 2019-03-23 20:09:49 +01:00
mcb
md bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata 2019-03-23 20:10:13 +01:00
media media: v4l2-ctrls.c/uvc: zero v4l2_event 2019-03-27 14:14:41 +09:00
memory
memstick memstick: Prevent memstick host from getting runtime suspended during card detection 2019-02-12 19:47:10 +01:00
message
mfd mfd: sm501: Fix potential NULL pointer dereference 2019-03-23 20:10:09 +01:00
misc cxl: Wrap iterations over afu slices inside 'afu_list_lock' 2019-03-23 20:10:03 +01:00
mmc mmc: renesas_sdhi: limit block count to 16 bit for old revisions 2019-03-27 14:14:38 +09:00
mtd mtd: rawnand: gpmi: fix MX28 bus master lockup problem 2019-02-15 08:10:10 +01:00
mux mux: adgs1408: use the correct MODULE_LICENSE 2018-10-12 17:36:39 +02:00
net can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument 2019-03-23 20:10:05 +01:00
nfc NFC: nfcmrvl_uart: fix OF child-node lookup 2018-11-13 11:08:48 -08:00
ntb
nubus
nvdimm libnvdimm: Fix altmap reservation size calculation 2019-03-23 20:09:53 +01:00
nvme nvme-pci: add missing unlock for reset error 2019-03-13 14:02:38 -07:00
nvmem nvmem: check the return value of nvmem_add_cells() 2018-11-13 11:08:35 -08:00
of of: overlay: do not duplicate properties from overlay for new nodes 2019-02-06 17:30:16 +01:00
opp OPP: Use opp_table->regulators to verify no regulator case 2019-02-12 19:47:08 +01:00
oprofile
parisc
parport parport_pc: fix find_superio io compare code, should use equal test. 2019-03-23 20:10:05 +01:00
pci PCI: dwc: skip MSI init if MSIs have been explicitly disabled 2019-03-23 20:10:02 +01:00
pcmcia pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges 2018-11-13 11:08:17 -08:00
perf perf: arm_spe: handle devm_kasprintf() failure 2019-02-12 19:47:03 +01:00
phy phy: ath79-usb: Fix the main reset name to match the DT binding 2019-03-05 17:58:48 +01:00
pinctrl pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins 2019-03-23 20:09:49 +01:00
platform platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 2019-03-13 14:02:31 -07:00
pnp
power cpcap-charger: generate events for userspace 2019-03-23 20:10:09 +01:00
powercap
pps
ps3
ptp ptp: Fix pass zero to ERR_PTR() in ptp_clock_register 2019-02-12 19:47:01 +01:00
pwm
rapidio
ras
regulator regulator: s2mpa01: Fix step values for some LDOs 2019-03-23 20:09:58 +01:00
remoteproc remoteproc: qcom: q6v5: Propagate EPROBE_DEFER 2018-11-13 11:08:52 -08:00
reset
rpmsg rpmsg: smd: fix memory leak on channel create 2018-11-13 11:08:55 -08:00
rtc rtc: m41t80: Correct alarm month range with RTC reads 2019-01-09 17:38:48 +01:00
s390 s390/virtio: handle find on invalid queue gracefully 2019-03-23 20:09:58 +01:00
sbus drivers/sbus/char: add of_node_put() 2018-12-21 14:15:17 +01:00
scsi scsi: ibmvscsi: Fix empty event pool access during host removal 2019-03-27 14:14:40 +09:00
sfi
sh
siox
slimbus slimbus: ngd: mark PM functions as __maybe_unused 2018-12-19 19:19:49 +01:00
sn
soc soc: qcom: rpmh: Avoid accessing freed memory from batch API 2019-03-23 20:10:00 +01:00
soundwire
spi spi: pxa2xx: Setup maximum supported DMA transfer length 2019-03-23 20:09:57 +01:00
spmi
ssb
staging media: imx: csi: Stop upstream before disabling IDMA channel 2019-03-23 20:10:12 +01:00
target scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock 2019-03-23 20:09:59 +01:00
tc TC: Set DMA masks for devices 2018-11-13 11:08:51 -08:00
tee tee: optee: avoid possible double list_del() 2019-02-12 19:47:08 +01:00
thermal drivers: thermal: int340x_thermal: Fix sysfs race condition 2019-03-05 17:58:48 +01:00
thunderbolt thunderbolt: Prevent root port runtime suspend during NVM upgrade 2018-12-17 09:24:36 +01:00
tty vt: perform safe console erase in the right order 2019-03-23 20:10:10 +01:00
uio uio: Fix an Oops on load 2018-11-27 16:13:09 +01:00
usb usb: typec: tps6598x: handle block writes separately with plain-I2C adapters 2019-03-23 20:10:04 +01:00
uwb
vfio vfio/type1: Fix unmap overflow off-by-one 2019-01-16 22:04:34 +01:00
vhost vhost/vsock: fix vhost vsock cid hashing inconsistent 2019-03-19 13:12:42 +01:00
video udlfb: handle unplug properly 2019-02-27 10:09:03 +01:00
virt vbox: fix link error with 'gcc -Og' 2019-02-12 19:46:59 +01:00
virtio
visorbus
vlynq
vme
w1 w1: omap-hdq: fix missing bus unregister at removal 2018-11-13 11:08:48 -08:00
watchdog watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem 2019-02-27 10:08:52 +01:00
xen pvcalls-front: fix potential null dereference 2019-02-27 10:08:56 +01:00
zorro
Kconfig
Makefile