github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
d72adfacc3
linux/drivers/misc
History
Linmao Li 220190f97d misc: issei: check bus message length before reading the command 
__issei_ham_process_ham_rsp() dispatches on hdr->cmd before the message
length is validated. The length comes from the firmware-owned DMA header
read in issei_dma_read(), which only bounds it from above, so firmware
sending a short bus message reaches the dispatch with less than
sizeof(struct ham_bus_message) bytes available.

For a zero-length message kmemdup() returns ZERO_SIZE_PTR, which passes
the NULL check in issei_dma_read(), and the dispatch dereferences it. A
length of one to three bytes gives a slab out-of-bounds read instead.

Reject bus messages shorter than the header before touching it, the way
the individual response handlers already validate their own length.

Fixes: 7bd4b9991d ("issei: implement main thread and ham messages")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260731025952.3505287-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:27:46 +02:00
..
altera-stapl Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
amd-sbi misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
bcm-vk misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
c2port Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cardreader misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
cb710 misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
eeprom misc: eeprom: idt_89hpesx: Unify style of of_device_id array 2026-07-31 14:20:50 +02:00
genwqe misc: genwqe: Drop unused assignment of pci_device_id driver data 2026-07-31 14:20:50 +02:00
ibmasm misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
issei misc: issei: check bus message length before reading the command 2026-07-31 14:27:46 +02:00
keba misc: Use named initializers for arrays of spi_device_data 2026-07-31 14:20:50 +02:00
lis3lv02d misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
lkdtm string: Remove strncpy() from the kernel 2026-06-18 16:39:31 -07:00
mchp_pci1xxxx misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
mei misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
ocxl misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
pvpanic misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
rp1 misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
sgi-gru misc: sgi-gru: inline the user CBR status update 2026-07-31 14:15:54 +02:00
sgi-xp Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
uacce Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmw_vmci misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
ad525x_dpot-i2c.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
ad525x_dpot-spi.c misc: Use named initializers for arrays of spi_device_data 2026-07-31 14:20:50 +02:00
ad525x_dpot.c misc: ad525x_dpot: use driver core groups for sysfs files 2026-07-17 15:50:10 +02:00
ad525x_dpot.h misc: ad525x_dpot: use driver core groups for sysfs files 2026-07-17 15:50:10 +02:00
apds9802als.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
atmel-ssc.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
bh1770glc.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
cs5535-mfgpt.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ds1682.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
dummy-irq.c
dw-xdata-pcie.c dw-xdata: Use str_write_read() in dw_xdata_start() and dw_xdata_perf() 2025-09-06 15:59:39 +02:00
enclosure.c drivers/misc/enclosure: Replace strcpy() + strcat() with snprintf() 2026-07-17 15:49:07 +02:00
fastrpc.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
gehc-achc.c misc: Use named initializers for arrays of spi_device_data 2026-07-31 14:20:50 +02:00
hi6421v600-irq.c misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
hmc6352.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
hpilo.c misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
hpilo.h
ibmvmc.c misc: ibmvmc: Use named initializers for vio_device_id array 2026-07-31 14:20:50 +02:00
ibmvmc.h
ics932s401.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
isl29003.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
isl29020.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
Kconfig misc: hisi_hikey_usb: remove untested role-switch driver 2026-07-31 14:26:48 +02:00
kgdbts.c Char/Misc/IIO driver changes for 7.0-rc1 2026-02-17 09:11:04 -08:00
lan966x_pci.c misc: lan966x_pci: depopulate children on populate failure 2026-07-17 15:50:12 +02:00
lan966x_pci.dtso misc: lan966x_pci: Fix dtc warn 'Missing interrupt-parent' 2024-11-04 14:34:25 +01:00
lattice-ecp3-config.c misc: Use named initializers for arrays of spi_device_data 2026-07-31 14:20:50 +02:00
Makefile misc: hisi_hikey_usb: remove untested role-switch driver 2026-07-31 14:26:48 +02:00
mrvl_cn10k_dpi.c misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
nsm.c misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
ntsync.c ntsync: reject wait ioctls with zero owner 2026-07-31 14:15:54 +02:00
open-dice.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
pch_phub.c misc: pch_phub: Make MAC address configuration more robust 2026-07-17 15:49:01 +02:00
pci_endpoint_test.c misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
phantom.c misc: Unify code style for various *_device_id arrays 2026-07-31 14:20:50 +02:00
qcom-coincell.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
rpmb-core.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smpro-errmon.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
smpro-misc.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
sram-exec.c
sram.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
sram.h
ti_fpc202.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
tifm_7xx1.c misc: tifm: Use PCI_VDEVICE to initialize pci_device_id array 2026-05-23 13:47:33 +02:00
tifm_core.c memstick: Constify the driver id_table 2026-05-11 16:59:43 +02:00
tps6594-esm.c misc: Remove redundant dev_err()/dev_err_probe() 2026-07-17 14:56:17 +02:00
tps6594-pfsm.c misc: Remove redundant dev_err()/dev_err_probe() 2026-07-17 14:56:17 +02:00
tsl2550.c misc: Use named initializers for arrays of i2c_device_data 2026-07-31 14:20:50 +02:00
vcpu_stall_detector.c misc: Unify style of of_device_id arrays 2026-07-31 14:20:50 +02:00
vmw_balloon.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xilinx_sdfec.c misc: xilinx_sdfec: validate LDPC code register offsets 2026-07-17 15:50:22 +02:00
xilinx_tmr_inject.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
xilinx_tmr_manager.c misc: Explicitly include correct DT includes 2023-08-04 15:39:04 +02:00