599f4c7b5d
commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream. In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied form userland. The parameter "req->data[2]" is missing check, the array size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and adb_handler[req->data[2]].handler_id will lead to oob read. Cc: stable <stable@kernel.org> Signed-off-by: Ning Qiang <sohu0106@126.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| ams | ||
| adb-iop.c | ||
| adb.c | ||
| adbhid.c | ||
| ans-lcd.c | ||
| ans-lcd.h | ||
| apm_emu.c | ||
| Kconfig | ||
| mac_hid.c | ||
| macio_asic.c | ||
| macio_sysfs.c | ||
| macio-adb.c | ||
| Makefile | ||
| mediabay.c | ||
| rack-meter.c | ||
| smu.c | ||
| therm_adt746x.c | ||
| therm_windtunnel.c | ||
| via-cuda.c | ||
| via-macii.c | ||
| via-pmu-backlight.c | ||
| via-pmu-event.c | ||
| via-pmu-event.h | ||
| via-pmu-led.c | ||
| via-pmu.c | ||
| windfarm_ad7417_sensor.c | ||
| windfarm_core.c | ||
| windfarm_cpufreq_clamp.c | ||
| windfarm_fcu_controls.c | ||
| windfarm_lm75_sensor.c | ||
| windfarm_lm87_sensor.c | ||
| windfarm_max6690_sensor.c | ||
| windfarm_mpu.h | ||
| windfarm_pid.c | ||
| windfarm_pid.h | ||
| windfarm_pm72.c | ||
| windfarm_pm81.c | ||
| windfarm_pm91.c | ||
| windfarm_pm112.c | ||
| windfarm_pm121.c | ||
| windfarm_rm31.c | ||
| windfarm_smu_controls.c | ||
| windfarm_smu_sat.c | ||
| windfarm_smu_sensors.c | ||
| windfarm.h | ||