Jakob Koschel 778302ca09 vt_ioctl: fix array_index_nospec in vt_setactivate ... commit 61cc70d9e8 upstream. array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be decreased first and then sanitized with array_index_nospec. Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam. Co-developed-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com> Signed-off-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com> Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com> Link: https://lore.kernel.org/r/20220127144406.3589293-1-jakobkoschel@gmail.com Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-16 12:54:27 +01:00
..
hvc	xen/console: harden hvc_xen against event channel storms	2021-12-22 09:30:59 +01:00
ipwireless
serdev
serial	tty: Add support for Brainboxes UC cards.	2022-02-01 17:25:40 +01:00
vt	vt_ioctl: fix array_index_nospec in vt_setactivate	2022-02-16 12:54:27 +01:00
amiserial.c	tty: amiserial: fix TIOCSSERIAL permission check	2021-05-14 09:49:55 +02:00
cyclades.c
ehv_bytechan.c
goldfish.c
isicom.c
Kconfig
Makefile
mips_ejtag_fdc.c
moxa.c	tty: moxa: fix TIOCSSERIAL permission check	2021-05-14 09:49:56 +02:00
moxa.h
mxser.c
mxser.h
n_gsm.c	tty: n_gsm: fix SW flow control encoding/handling	2022-02-01 17:25:40 +01:00
n_hdlc.c	tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous	2021-12-22 09:30:56 +01:00
n_null.c
n_r3964.c
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c
nozomi.c	tty: nozomi: Fix the error handling path of 'nozomi_card_init()'	2021-07-14 16:56:39 +02:00
pty.c
rocket_int.h
rocket.c
rocket.h
synclink_gt.c	tty: synclink_gt: rename a conflicting function name	2021-09-30 10:11:03 +02:00
synclink.c
synclinkmp.c
sysrq.c
tty_audit.c
tty_baudrate.c
tty_buffer.c	tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc	2021-11-26 10:39:10 +01:00
tty_io.c	tty: Fix data race between tiocsti() and flush_to_ldisc()	2021-09-15 09:50:47 +02:00
tty_ioctl.c	tty: fix return value for unsupported termiox ioctls	2021-05-14 09:50:19 +02:00
tty_jobctrl.c
tty_ldisc.c
tty_ldsem.c
tty_mutex.c
tty_port.c
ttynull.c
vcc.c