Ning Qiang 3a0ef79c6a macintosh/adb: fix oob read in do_adb_query() function ... commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream. In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied form userland. The parameter "req->data[2]" is missing check, the array size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and adb_handler[req->data[2]].handler_id will lead to oob read. Cc: stable <stable@kernel.org> Signed-off-by: Ning Qiang <sohu0106@126.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-11 12:57:53 +02:00
..
ams
adb-iop.c
adb.c	macintosh/adb: fix oob read in do_adb_query() function	2022-08-11 12:57:53 +02:00
adbhid.c
ans-lcd.c
ans-lcd.h
apm_emu.c
Kconfig
mac_hid.c
macio_asic.c
macio_sysfs.c
macio-adb.c
Makefile
mediabay.c
rack-meter.c
smu.c
therm_adt746x.c
therm_windtunnel.c
via-cuda.c
via-macii.c
via-pmu-backlight.c
via-pmu-event.c
via-pmu-event.h
via-pmu-led.c
via-pmu.c
windfarm_ad7417_sensor.c
windfarm_core.c
windfarm_cpufreq_clamp.c
windfarm_fcu_controls.c
windfarm_lm75_sensor.c
windfarm_lm87_sensor.c
windfarm_max6690_sensor.c
windfarm_mpu.h
windfarm_pid.c
windfarm_pid.h
windfarm_pm72.c
windfarm_pm81.c
windfarm_pm91.c
windfarm_pm112.c
windfarm_pm121.c
windfarm_rm31.c
windfarm_smu_controls.c
windfarm_smu_sat.c
windfarm_smu_sensors.c
windfarm.h