Evgeny Novikov a61698358b mtd: rawnand: intel: Fix potential buffer overflow in probe ... [ Upstream commit 46a0dc10fb ] ebu_nand_probe() read the value of u32 variable "cs" from the device firmware description and used it as the index for array ebu_host->cs that can contain MAX_CS (2) elements at most. That could result in a buffer overflow and various bad consequences later. Fix the potential buffer overflow by restricting values of "cs" with MAX_CS in probe. Found by Linux Driver Verification project (linuxtesting.org). Fixes: 0b1039f016 ("mtd: rawnand: Add NAND controller support on Intel LGM SoC") Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com> Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com> Co-developed-by: Anton Vasilyev <vasilyev@ispras.ru> Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20210903082653.16441-1-novikov@ispras.ru Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-11-18 19:16:58 +01:00
..
accessibility
acpi	ACPI: PM: Fix sharing of wakeup power resources	2021-11-18 19:16:35 +01:00
amba	ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"	2021-11-06 14:13:31 +01:00
android	binder: don't detect sender/target during buffer cleanup	2021-11-12 15:05:49 +01:00
ata	libata: fix checking of DMA state	2021-11-18 19:16:00 +01:00
atm
auxdisplay
base	driver core: Fix possible memory leak in device_link_add()	2021-11-18 19:16:50 +01:00
bcma
block	block: ataflop: more blk-mq refactoring fixes	2021-11-18 19:16:41 +01:00
bluetooth	Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs	2021-11-18 19:16:25 +01:00
bus	bus: ti-sysc: Fix timekeeping_suspended warning on resume	2021-11-18 19:16:48 +01:00
cdrom
char	ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()'	2021-11-18 19:16:44 +01:00
clk	clk: at91: clk-master: fix prescaler logic	2021-11-18 19:16:56 +01:00
clocksource	clocksource/drivers/timer-ti-dm: Select TIMER_OF	2021-11-18 19:16:39 +01:00
comedi	comedi: vmk80xx: fix bulk and interrupt message timeouts	2021-11-12 15:05:51 +01:00
connector
counter
cpufreq	cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization	2021-11-18 19:16:42 +01:00
cpuidle	cpuidle: Fix kobject memory leaks in error paths	2021-11-18 19:16:29 +01:00
crypto	crypto: octeontx2 - set assoclen in aead_do_fallback()	2021-11-18 19:16:33 +01:00
cxl	cxl/pci: Fix NULL vs ERR_PTR confusion	2021-11-18 19:16:04 +01:00
dax
dca
devfreq
dio
dma
dma-buf	dma-buf: WARN on dmabuf release with pending attachments	2021-11-18 19:16:08 +01:00
edac	EDAC/amd64: Handle three rank interleaving mode	2021-11-18 19:16:30 +01:00
eisa
extcon
firewire
firmware	firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()	2021-11-18 19:16:55 +01:00
fpga	fpga: ice40-spi: Add SPI device ID table	2021-09-27 14:00:41 -07:00
fsi
gnss
gpio	gpio: mlxbf2.c: Add check for bgpio_init failure	2021-10-25 10:15:05 +02:00
gpu	drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits	2021-11-18 19:16:43 +01:00
greybus
hid	HID: u2fzero: properly handle timeouts in usb_submit_urb	2021-11-18 19:16:56 +01:00
hsi
hv	hyperv-fixes for 5.15	2021-10-22 10:31:32 -10:00
hwmon	hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff	2021-11-18 19:16:32 +01:00
hwspinlock
hwtracing	coresight: trbe: Defer the probe on offline CPUs	2021-11-18 19:16:06 +01:00
i2c	i2c: mlxcpld: Modify register setting for 400KHz frequency	2021-10-04 21:56:20 +02:00
i3c
idle
iio	iio: adis: do not disabe IRQs in 'adis_init()'	2021-11-18 19:16:54 +01:00
infiniband	RDMA/core: Require the driver to set the IOVA correctly during rereg_mr	2021-11-18 19:16:58 +01:00
input	Input: i8042 - Add quirk for Fujitsu Lifebook T725	2021-11-18 19:15:51 +01:00
interconnect
iommu	iommu/dma: Fix incorrect error return on iommu deferred attach	2021-11-18 19:16:57 +01:00
ipack	ipack: ipoctal: fix module reference leak	2021-09-27 17:38:49 +02:00
irqchip	irq: mips: avoid nested irq_enter()	2021-11-18 19:16:40 +01:00
isdn	mISDN: Fix return values of the probe function	2021-10-19 13:09:28 +01:00
leds
macintosh	memblock: introduce saner 'memblock_free_ptr()' interface	2021-09-14 13:23:22 -07:00
mailbox	mailbox: mtk-cmdq: Fix local clock ID usage	2021-11-18 19:16:35 +01:00
mcb	mcb: fix error handling in mcb_alloc_bus()	2021-09-14 11:22:26 +02:00
md	md: update superblock after changing rdev flags in state_store	2021-11-18 19:16:16 +01:00
media	media: ir_toy: assignment to be16 should be of correct type	2021-11-18 19:16:34 +01:00
memory	memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe	2021-11-18 19:16:51 +01:00
memstick	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()	2021-11-18 19:16:32 +01:00
message
mfd	mfd: simple-mfd-i2c: Select MFD_CORE to fix build error	2021-11-18 19:16:06 +01:00
misc	eeprom: 93xx46: fix MODULE_DEVICE_TABLE	2021-10-15 10:54:02 +02:00
mmc	mmc: mxs-mmc: disable regulator on error and in the remove function	2021-11-18 19:16:34 +01:00
most	most: fix control-message timeouts	2021-11-18 19:16:08 +01:00
mtd	mtd: rawnand: intel: Fix potential buffer overflow in probe	2021-11-18 19:16:58 +01:00
mux
net	ibmvnic: delay complete()	2021-11-18 19:16:45 +01:00
nfc	nfc: port100: fix using -ERRNO as command type mask	2021-10-26 13:42:00 +01:00
ntb
nubus
nvdimm	nvdimm/pmem: stop using q_usage_count as external pgmap refcount	2021-10-25 16:12:32 -07:00
nvme	nvme-rdma: fix error code in nvme_rdma_setup_ctrl	2021-11-18 19:16:38 +01:00
nvmem	nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells	2021-10-13 15:09:58 +02:00
of	of: unittest: fix EXPECT text for gpio hog errors	2021-11-18 19:16:45 +01:00
opp
parisc
parport
pci	PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge	2021-11-18 19:16:05 +01:00
pcmcia
perf	KVM: arm64: Fix PMU probe ordering	2021-09-20 12:43:34 +01:00
phy	phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()	2021-11-18 19:16:56 +01:00
pinctrl	pinctrl: equilibrium: Fix function addition in multiple groups	2021-11-18 19:16:55 +01:00
platform	platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning	2021-11-18 19:16:34 +01:00
pnp
power	power: supply: bq27xxx: Fix kernel crash on IRQ handler register error	2021-11-18 19:16:58 +01:00
powercap
pps
ps3
ptp	ptp: free 'vclock_index' in ptp_clock_release()	2021-10-21 12:50:38 +01:00
pwm
rapidio
ras
regulator	regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled	2021-11-18 19:15:57 +01:00
remoteproc
reset	reset: socfpga: add empty driver allowing consumers to probe	2021-10-05 12:23:16 +02:00
rpmsg
rtc	rtc: cmos: Disable irq around direct invocation of cmos_interrupt()	2021-09-14 10:20:19 +02:00
s390	s390 updates for 5.15-rc4	2021-10-01 14:45:23 -07:00
sbus
scsi	scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset	2021-11-18 19:16:54 +01:00
sh
siox
slimbus
soc	soc: qcom: apr: Add of_node_put() before return	2021-11-18 19:16:55 +01:00
soundwire	soundwire: bus: stop dereferencing invalid slave pointer	2021-11-18 19:16:54 +01:00
spi	spi: spi-rpc-if: Check return value of rpcif_sw_init()	2021-11-18 19:16:42 +01:00
spmi
ssb
staging	staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC	2021-11-18 19:16:52 +01:00
target	scsi: target: Fix spelling mistake "CONFLIFT" -> "CONFLICT"	2021-09-22 00:17:29 -04:00
tc
tee	tee: optee: Fix missing devices unregister during optee_remove	2021-10-12 13:24:39 +02:00
thermal	thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM	2021-11-18 19:16:34 +01:00
thunderbolt	thunderbolt: build kunit tests without structleak plugin	2021-10-06 17:53:49 -06:00
tty	serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE	2021-11-18 19:16:57 +01:00
uio
usb	usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized	2021-11-18 19:16:54 +01:00
vdpa	vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit	2021-11-18 19:16:58 +01:00
vfio	vfio/pci: add missing identifier name in argument of function prototype	2021-09-23 14:12:36 -06:00
vhost	virtio,vdpa: fixes	2021-10-17 18:17:19 -10:00
video	video: fbdev: chipsfb: use memset_io() instead of memset()	2021-11-18 19:16:51 +01:00
virt
virtio	virtio_ring: check desc == NULL when using indirect with packed	2021-11-18 19:16:58 +01:00
visorbus
vlynq
vme
w1
watchdog	watchdog: Fix OMAP watchdog early handling	2021-10-26 20:22:51 +02:00
xen	xen/balloon: add late_initcall_sync() for initial ballooning done	2021-11-18 19:16:04 +01:00
zorro
Kconfig	firmware: include drivers/firmware/Kconfig unconditionally	2021-10-07 16:51:26 +02:00
Makefile