Anirudh Rayabharam 8c064eece9 HID: usbhid: fix info leak in hid_submit_ctrl ... [ Upstream commit 6be388f4a3 ] In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Reported-by: syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-06-30 08:48:45 -04:00
..
accessibility
acpi	ACPI: scan: Fix a memory leak in an error handling path	2021-05-22 10:57:40 +02:00
amba	amba: Fix resource leak for drivers without .remove	2021-03-03 18:22:46 +01:00
android	binder: fix UAF when releasing todo list	2020-10-29 09:06:59 +01:00
ata	ata: libahci_platform: fix IRQ check	2021-05-22 10:57:31 +02:00
atm	atm: idt77252: fix null-ptr-dereference	2021-03-30 14:40:09 +02:00
auxdisplay	auxdisplay: ht16k33: Fix refresh rate handling	2021-03-03 18:22:46 +01:00
base	Revert "PM: runtime: Update device status before letting suppliers suspend"	2021-03-24 11:04:55 +01:00
bcma
block	xen-blkback: don't leak persistent grants from xen_blkbk_map()	2021-03-30 14:40:13 +02:00
bluetooth	Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function	2021-03-03 18:22:37 +01:00
bus	bus: qcom: Put child node before return	2021-05-22 10:57:28 +02:00
cdrom	cdrom: gdrom: initialize global variable at init time	2021-05-26 11:47:00 +02:00
char	char: hpet: add checks after calling ioremap	2021-06-03 08:36:21 +02:00
clk	clk: exynos7: Mark aclk_fsys1_200 as critical	2021-05-22 10:57:41 +02:00
clocksource	clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined	2021-03-03 18:22:45 +01:00
connector
cpufreq	cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove()	2021-03-03 18:22:38 +01:00
cpuidle	cpuidle: Fixup IRQ state	2020-09-09 19:03:06 +02:00
crypto	crypto: qat - Fix a double free in adf_create_ring	2021-05-22 10:57:29 +02:00
dax
dca
devfreq	PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out	2020-10-01 13:12:28 +02:00
dio
dma	dmaengine: qcom_hidma: comment platform_driver_register call	2021-06-03 08:36:21 +02:00
dma-buf
edac	EDAC/amd64: Fix PCI component registration	2020-12-29 13:47:06 +01:00
eisa
extcon	extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged	2021-05-22 10:57:18 +02:00
firewire	firewire: nosy: Fix a use-after-free bug in nosy_ioctl()	2021-04-07 12:47:03 +02:00
firmware	efi: cper: fix snprintf() use in cper_dimm_err_location()	2021-06-10 12:43:49 +02:00
fmc
fpga
fsi
gpio	gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055	2021-05-22 10:57:42 +02:00
gpu	drm: Lock pointer access in drm_master_release()	2021-06-16 11:53:02 +02:00
hid	HID: usbhid: fix info leak in hid_submit_ctrl	2021-06-30 08:48:45 -04:00
hsi	HSI: core: fix resource leaks in hsi_add_client_from_dt()	2021-05-22 10:57:31 +02:00
hv	Drivers: hv: vmbus: Increase wait time for VMbus unload	2021-05-22 10:57:30 +02:00
hwmon	Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"	2021-05-26 11:47:00 +02:00
hwspinlock
hwtracing	intel_th: pci: Add Alder Lake-M support	2021-05-22 10:57:21 +02:00
i2c	i2c: mpc: implement erratum A-004447 workaround	2021-06-16 11:53:02 +02:00
ide	scsi: ide: Do not set the RQF_PREEMPT flag for sense requests	2021-01-12 20:09:05 +01:00
idle
iio	iio: adc: ad7793: Add missing error code in ad7793_setup()	2021-06-03 08:36:16 +02:00
infiniband	RDMA/rxe: Clear all QP fields if creation failed	2021-05-26 11:46:58 +02:00
input	Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state	2021-05-22 10:57:42 +02:00
iommu	iommu/vt-d: Fix sysfs leak in alloc_iommu()	2021-06-03 08:36:12 +02:00
ipack
irqchip	irqchip/mips-cpu: Set IPI domain parent chip	2021-01-30 13:31:13 +01:00
isdn	isdn: mISDN: netjet: Fix crash in nj_probe:	2021-06-16 11:53:00 +02:00
leds	leds: lp5523: check return value of lp5xx_read and jump to cleanup code	2021-05-26 11:47:01 +02:00
lightnvm
macintosh
mailbox	mailbox: avoid timer start from callback	2020-10-29 09:07:11 +01:00
mcb
md	dm snapshot: properly fix a crash when an origin has no snapshots	2021-06-03 08:36:15 +02:00
media	media: gspca: properly check for errors in po1030_probe()	2021-06-03 08:36:21 +02:00
memory	memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]	2021-05-22 10:57:26 +02:00
memstick	memstick: r592: Fix error return in r592_probe()	2020-12-29 13:46:58 +01:00
message	scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()	2020-11-05 11:06:59 +01:00
mfd	mfd: stm32-timers: Avoid clearing auto reload register	2021-05-22 10:57:31 +02:00
misc	platform/x86: hp_accel: Avoid invoking _INI to speed up resume	2021-06-03 08:36:20 +02:00
mmc	mmc: core: Set read only for SD cards with permanent write protect bit	2021-05-22 10:57:15 +02:00
mtd	mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init	2021-05-22 10:57:28 +02:00
mux
net	bnx2x: Fix missing error code in bnx2x_iov_init_one()	2021-06-16 11:53:02 +02:00
nfc	nfc: pn533: prevent potential memory corruption	2021-05-22 10:57:32 +02:00
ntb	NTB: hw: amd: fix an issue about leak system resources	2020-10-29 09:07:14 +01:00
nubus
nvdimm	libnvdimm/dimm: Avoid race between probe and available_slots_show()	2021-03-03 18:22:54 +01:00
nvme	nvme-rdma: fix possible hang when failing to set io queues	2021-03-24 11:05:01 +01:00
nvmem
of	Revert "fdt: Properly handle "no-map" field in the memory region"	2021-05-22 10:57:35 +02:00
oprofile
parisc
parport
pci	ACPI / hotplug / PCI: Fix reference count leak in enable_slot()	2021-05-22 10:57:42 +02:00
pcmcia
perf	perf/arm_pmu_platform: Fix error handling	2021-05-22 10:57:17 +02:00
phy	phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally	2021-05-22 10:57:28 +02:00
pinctrl	pinctrl: samsung: use 'int' for register masks in Exynos	2021-05-22 10:57:36 +02:00
platform	platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI	2021-06-03 08:36:22 +02:00
pnp
power	power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()	2021-05-22 10:57:19 +02:00
powercap	powercap: restrict energy meter to root access	2020-11-10 21:10:28 +01:00
pps
ps3	powerpc/ps3: use dma_mapping_error()	2020-12-29 13:47:02 +01:00
ptp
pwm	pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()	2021-03-03 18:22:48 +01:00
rapidio	rapidio: handle create_workqueue() failure	2021-05-26 11:46:59 +02:00
ras
regulator	regulator: max77620: Use device_set_of_node_from_dev()	2021-06-16 11:53:04 +02:00
remoteproc	remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load	2021-02-23 14:00:29 +01:00
reset
rpmsg	rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()	2021-05-22 10:57:38 +02:00
rtc	rtc: ds1307: Fix wday settings for rx8130	2021-05-22 10:57:38 +02:00
s390	s390/dasd: fix hanging IO request during DASD driver unbind	2021-03-17 16:34:31 +01:00
sbus
scsi	scsi: core: Only put parent device if host state differs from SHOST_CREATED	2021-06-16 11:53:04 +02:00
sfi
sh
sn
soc	soc: qcom: mdt_loader: Detect truncated read of segments	2021-05-22 10:57:29 +02:00
spi	spi: Fix use-after-free with devm_spi_alloc_*	2021-05-22 10:57:29 +02:00
spmi
ssb
staging	staging: rtl8723bs: Fix uninitialized variables	2021-06-16 11:53:02 +02:00
target	scsi: target: pscsi: Fix warning in pscsi_complete_cmd()	2021-05-22 10:57:18 +02:00
tc
tee	tee: optee: do not check memref size on return from Secure World	2021-05-22 10:57:16 +02:00
thermal	thermal/core/fair share: Lock the thermal zone while looping over instances	2021-05-22 10:57:41 +02:00
thunderbolt	thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue	2021-06-03 08:36:15 +02:00
tty	serial: max310x: unregister uart driver in case of failure and abort	2021-06-03 08:36:20 +02:00
uio	uio: Fix use-after-free in uio_unregister_device()	2020-11-18 18:27:58 +01:00
usb	usb: fix various gadget panics on 10gbps cabling	2021-06-16 11:53:03 +02:00
uwb
vfio	vfio/platform: fix module_put call in error flow	2021-06-10 12:43:50 +02:00
vhost	vhost: Fix vhost_vq_reset()	2021-04-07 12:47:01 +02:00
video	video: hgafb: correctly handle card detect failure during probe	2021-05-26 11:47:01 +02:00
virt	drivers/virt/fsl_hypervisor: Fix error handling path	2020-10-29 09:07:05 +01:00
virtio
vlynq
vme
w1	w1: mxc_w1: Fix timeout resolution problem leading to bus error	2020-11-05 11:06:59 +01:00
watchdog	watchdog: mei_wdt: request stop on unregister	2021-03-03 18:22:54 +01:00
xen	xen-pciback: redo VF placement in the virtual topology	2021-06-10 12:43:53 +02:00
zorro
Kconfig
Makefile