Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-16 18:26:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux-stable/drivers
History
Michael S. Tsirkin f0213f63e1 vhost: validate vhost_get_vq_desc return value 
[ Upstream commit a39ee449f96a2cd44ce056d8a0a112211a9b1a1f ]

vhost fails to validate negative error code
from vhost_get_vq_desc causing
a crash: we are using -EFAULT which is 0xfffffff2
as vector size, which exceeds the allocated size.

The code in question was introduced in commit
8dd014adfea6f173c1ef6378f7e5e7924866c923
    vhost-net: mergeable buffers support

CVE-2014-0055

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-14 06:47:21 -07:00
..
accessibility
…
acpi
ACPI / sleep: Add extra checks for HW Reduced ACPI mode sleep states
2014-03-23 21:44:12 -07:00
amba
…
ata
libata: use wider match for blacklisting Crucial M500
2014-03-23 21:44:10 -07:00
atm
atm: idt77252: fix dev refcnt leak
2013-11-19 15:53:02 -05:00
auxdisplay
…
base
PM / hibernate: Fix restore hang in freeze_processes()
2014-03-06 22:06:29 -08:00
bcma
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-11-13 17:40:34 +09:00
block
mm: close PageTail race
2014-04-03 12:02:37 -07:00
bluetooth
Bluetooth: Add support for Toshiba Bluetooth device [0930:0220]
2013-12-04 11:11:49 -02:00
bus
Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm
2013-11-14 08:51:29 +09:00
cdrom
…
char
raw: test against runtime value of max_raw_minors
2014-02-22 13:34:46 -08:00
clk
clk: clk-divider: fix divisor > 255 bug
2014-01-08 08:33:12 -08:00
clocksource
clocksource: vf_pit_timer: use complement for sched_clock reading
2014-03-31 10:05:13 -07:00
connector
connector: improved unaligned access error fix
2013-11-14 17:19:20 -05:00
cpufreq
intel_pstate: Add support for Baytrail turbo P states
2014-03-23 21:44:19 -07:00
cpuidle
ARM/cpuidle: remove __init tag from Calxeda cpuidle probe function
2013-12-30 11:55:20 +01:00
crypto
crypto: ixp4xx - Fix kernel compile error
2014-01-01 14:06:23 +08:00
dca
…
devfreq
…
dio
…
dma
dma: ste_dma40: don't dereference free:d descriptor
2014-03-06 22:06:29 -08:00
edac
i7300_edac: Fix device reference count
2014-03-06 22:06:29 -08:00
eisa
Revert "EISA: Initialize device before its resources"
2014-02-13 13:55:27 -08:00
extcon
extcon: gpio: Request gpio pin before modifying its state
2014-01-29 05:06:18 -08:00
firewire
firewire: don't use PREPARE_DELAYED_WORK
2014-03-23 21:44:10 -07:00
firmware
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-12-29 13:35:04 -08:00
fmc
…
gpio
GPIO fixes for the v3.13 development cycle:
2013-12-17 11:47:40 -08:00
gpu
drm/i915: Undo gtt scratch pte unmapping again
2014-04-03 12:02:36 -07:00
hid
HID: hidraw: fix warning destroying hidraw device files after parent
2014-03-31 10:05:13 -07:00
hsi
…
hv
Drivers: hv: vmbus: Don't timeout during the initial connection with host
2014-02-22 13:34:53 -08:00
hwmon
hwmon: (max1668) Fix writing the minimum temperature
2014-03-06 22:06:25 -08:00
hwspinlock
…
i2c
i2c: cpm: Fix build by adding of_address.h and of_irq.h
2014-04-03 12:02:36 -07:00
ide
More ACPI and power management updates for 3.13-rc1
2013-11-20 13:25:04 -08:00
idle
intel_idle: close avn_cstates array with correct marker
2014-01-10 03:06:06 +01:00
iio
iio:gyro: bug on L3GD20H gyroscope support
2014-03-06 22:06:26 -08:00
infiniband
iser-target: Fix command leak for tx_desc->comp_llnode_batch
2014-03-23 21:44:13 -07:00
input
Input: cypress_ps2 - don't report as a button pads
2014-04-03 12:02:35 -07:00
iommu
iommu/arm-smmu: set CBARn.BPSHCFG to NSH for s1-s2-bypass contexts
2014-03-06 22:06:26 -08:00
ipack
…
irqchip
irq-metag*: stop set_affinity vectoring to offline cpus
2014-03-06 22:06:29 -08:00
isdn
isdn: Drop big endian cpp checks from telespci and hfc_pci drivers
2014-01-06 15:50:51 -05:00
leds
leds: lp5521/5523: Remove duplicate mutex
2014-01-10 14:48:07 -08:00
lguest
…
macintosh
powerpc/windfarm: Fix XServe G5 fan control Makefile issue
2013-11-27 11:35:47 +11:00
mailbox
…
md
dm cache: fix access beyond end of origin device
2014-03-23 21:44:17 -07:00
media
media: cx18: check for allocation failure in cx18_read_eeprom()
2014-03-31 10:05:14 -07:00
memory
…
memstick
tree-wide: use reinit_completion instead of INIT_COMPLETION
2013-11-15 09:32:21 +09:00
message
drivers/message/i2o/driver.c: add missing destroy_workqueue() on error in i2o_driver_register()
2013-11-13 12:09:26 +09:00
mfd
ASoC: da9055: Fix device registration of PMIC and CODEC devices
2014-03-06 22:06:18 -08:00
misc
mei: set client's read_cb to NULL when flow control fails
2014-03-06 22:06:24 -08:00
mmc
Fix uses of dma_max_pfn() when converting to a limiting address
2014-03-31 10:05:15 -07:00
mtd
mtd: nand: omap: fix ecclayout->oobfree->length
2014-03-06 22:06:25 -08:00
net
usbnet: include wait queue head in device structure
2014-04-14 06:47:21 -07:00
nfc
…
ntb
NTB driver bug fixes to address a missed call to pci_enable_msix,
2013-11-26 11:15:12 -08:00
nubus
…
of
of: fix PCI bus match for PCIe slots
2014-02-22 13:34:45 -08:00
oprofile
…
parisc
…
parport
parport: parport_pc: remove double PCI ID for NetMos
2014-02-06 11:34:01 -08:00
pci
PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not enabled
2014-03-23 21:44:16 -07:00
pcmcia
DeviceTree updates for 3.13. This is a bit larger pull request than
2013-11-12 16:52:17 +09:00
phy
phy: kconfig: add depends on "USB_PHY" to OMAP_USB2 and TWL4030_USB
2013-12-10 12:53:30 -08:00
pinctrl
pinctrl: sunxi: use chained_irq_{enter, exit} for GIC compatibility
2014-03-23 21:44:07 -07:00
platform
hp_accel: Add a new PnP ID HPQ6007 for new HP laptops
2014-02-06 11:34:06 -08:00
pnp
PNP / ACPI: proper handling of ACPI IO/Memory resource parsing failures
2014-03-23 21:44:20 -07:00
power
power: max17040: Fix NULL pointer dereference when there is no platform_data
2014-02-22 13:34:59 -08:00
powercap
powercap / RAPL: add support for ValleyView Soc
2013-12-22 01:27:51 +01:00
pps
drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr
2013-11-13 12:09:35 +09:00
ps3
…
ptp
…
pwm
…
rapidio
rapidio/tsi721: fix tasklet termination in dma channel release
2014-03-23 21:43:59 -07:00
regulator
regulator: core: Replace direct ops->disable usage
2014-03-31 10:05:15 -07:00
remoteproc
…
reset
…
rpmsg
…
rtc
rtc-cmos: Add an alarm disable quirk
2014-02-13 13:55:46 -08:00
s390
s390/3270: fix allocation of tty3270_screen structure
2013-12-18 17:35:30 +01:00
sbus
…
scsi
Fix uses of dma_max_pfn() when converting to a limiting address
2014-03-31 10:05:15 -07:00
sfi
…
sh
…
sn
…
spi
spi: spi-ath79: fix initial GPIO CS line setup
2014-03-23 21:44:11 -07:00
ssb
…
staging
zram: avoid null access when fail to alloc meta
2014-03-23 21:43:58 -07:00
target
iscsi-target: Fix iscsit_get_tpg_from_np tpg_state bug
2014-03-23 21:44:13 -07:00
tc
…
thermal
x86_pkg_temp_thermal: Do not expose as a hwmon device
2014-03-23 21:44:08 -07:00
tty
serial: omap-serial: Move info message to probe function
2014-02-22 13:34:49 -08:00
uio
uio: fix devm_request_irq usage
2014-02-06 11:34:00 -08:00
usb
xhci: Fix resume issues on Renesas chips in Samsung laptops
2014-03-31 10:05:16 -07:00
uwb
…
vfio
mm: close PageTail race
2014-04-03 12:02:37 -07:00
vhost
vhost: validate vhost_get_vq_desc return value
2014-04-14 06:47:21 -07:00
video
xen/pvhvm: If xen_platform_pci=0 is set don't blow up (v4).
2014-02-13 13:55:28 -08:00
virt
…
virtio
virtio_balloon: update_balloon_size(): update correct field
2013-12-05 13:12:39 +10:30
vlynq
…
vme
VME: Correct read/write alignment algorithm
2014-02-22 13:34:53 -08:00
w1
drivers/w1/masters/w1-gpio.c: use dev_get_platdata()
2013-11-15 09:32:21 +09:00
watchdog
sc1200_wdt: Fix oops
2013-12-10 08:48:15 +01:00
xen
xen/balloon: flush persistent kmaps in correct position
2014-04-03 12:02:35 -07:00
zorro
…
Kconfig
ACPI and power management updates for 3.13-rc1
2013-11-14 13:41:48 +09:00
Makefile
ACPI and power management updates for 3.13-rc1
2013-11-14 13:41:48 +09:00