Ning Qiang c81d1bb58c macintosh/adb: fix oob read in do_adb_query() function ... commit fd97e4ad6d upstream. In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied form userland. The parameter "req->data[2]" is missing check, the array size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and adb_handler[req->data[2]].handler_id will lead to oob read. Cc: stable <stable@kernel.org> Signed-off-by: Ning Qiang <sohu0106@126.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-11 13:07:54 +02:00
..
ams	…
Kconfig	…
Makefile	…
adb-iop.c	…
adb.c	macintosh/adb: fix oob read in do_adb_query() function	2022-08-11 13:07:54 +02:00
adbhid.c	…
ans-lcd.c	…
ans-lcd.h	…
apm_emu.c	…
mac_hid.c	…
macio-adb.c	…
macio_asic.c	…
macio_sysfs.c	…
mediabay.c	…
rack-meter.c	…
smu.c	…
therm_adt746x.c	…
therm_windtunnel.c	…
via-cuda.c	…
via-macii.c	…
via-pmu-backlight.c	…
via-pmu-event.c	…
via-pmu-event.h	…
via-pmu-led.c	…
via-pmu.c	…
windfarm.h	…
windfarm_ad7417_sensor.c	…
windfarm_core.c	…
windfarm_cpufreq_clamp.c	…
windfarm_fcu_controls.c	…
windfarm_lm75_sensor.c	…
windfarm_lm87_sensor.c	…
windfarm_max6690_sensor.c	…
windfarm_mpu.h	…
windfarm_pid.c	…
windfarm_pid.h	…
windfarm_pm72.c	…
windfarm_pm81.c	…
windfarm_pm91.c	…
windfarm_pm112.c	…
windfarm_pm121.c	…
windfarm_rm31.c	…
windfarm_smu_controls.c	…
windfarm_smu_sat.c	…
windfarm_smu_sensors.c	…