Kees Cook 2ca27aef6f HID: validate HID report id size ... The "Report ID" field of a HID report is used to build indexes of reports. The kernel's index of these is limited to 256 entries, so any malicious device that sets a Report ID greater than 255 will trigger memory corruption on the host: [ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878 [ 1347.156261] IP: [<ffffffff813e4da0>] hid_register_report+0x2a/0x8b CVE-2013-2888 Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>		2014-07-11 11:19:18 -07:00
..
acpi	ACPI / dock / PCI: Synchronous handling of dock events for PCI devices	2013-06-24 11:22:53 +02:00
asm-generic	Merge branch 'fixes' of git://git.kernel.org/pub/scm/virt/kvm/kvm	2013-06-11 11:16:43 -07:00
clocksource	ARM: late Exynos multiplatform changes	2013-05-07 11:28:42 -07:00
crypto	crypto: sha512 - Expose generic sha512 routine to be callable from other modules	2013-04-25 21:00:57 +08:00
drm	Merge branch 'drm-radeon-sun-hainan' of git://people.freedesktop.org/~airlied/linux	2013-05-21 08:50:57 -07:00
dt-bindings	ARM: dt: create a DT header for the GIC	2013-04-05 12:23:24 -06:00
keys
linux	HID: validate HID report id size	2014-07-11 11:19:18 -07:00
math-emu
media	Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media	2013-06-18 06:25:08 -10:00
memory
misc
net	Handle 'sk' being NULL in UID-based routing.	2014-07-08 18:58:21 +00:00
pcmcia
ras
rdma
rxrpc
scsi	Merge branch 'postmerge' into for-linus	2013-05-10 07:54:01 -07:00
sound	ASoC: dapm: Treat DAI widgets like AIF widgets for power	2013-06-07 15:54:50 +01:00
target	target: Propigate up ->cmd_kref put return via transport_generic_free_cmd	2013-05-31 01:21:23 -07:00
trace	mmc: Add tracepoints of mmc block operations	2013-07-01 14:16:26 -07:00
uapi	net: core: Support UID-based routing.	2014-06-25 12:41:52 +09:00
video	video: adf: fbdev: add stubs for kernels without ADF_FBDEV	2014-05-02 16:07:00 -07:00
xen	xenbus: delay xenbus frontend resume if xenstored is not running	2013-05-29 09:04:19 -04:00
Kbuild	UAPI: remove empty Kbuild files	2013-04-30 17:04:09 -07:00