mirror of
https://github.com/FEX-Emu/linux.git
synced 2024-12-24 10:28:57 +00:00
084b6e7765
The function c4_ioctl() writes data from user in ifr->ifr_data to the kernel struct data arg, without any iolen bounds checking. This can lead to a arbitrary write outside of the struct data arg. Corrected by adding bounds-checking of iolen before the copy_from_user(). Signed-off-by: Salva Peiró <speiro@ai2.upv.es> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
android | ||
bcm | ||
ced1401 | ||
comedi | ||
cptm1217 | ||
crystalhd | ||
cxt1e1 | ||
dgap | ||
dgnc | ||
dgrp | ||
echo | ||
et131x | ||
frontier | ||
ft1000 | ||
fwserial | ||
gdm72xx | ||
gdm724x | ||
goldfish | ||
iio | ||
imx-drm | ||
keucr | ||
line6 | ||
lustre | ||
media | ||
mt29f_spinand | ||
netlogic | ||
nvec | ||
octeon | ||
octeon-usb | ||
olpc_dcon | ||
ozwpan | ||
panel | ||
phison | ||
quickstart | ||
rtl8187se | ||
rtl8188eu | ||
rtl8192e | ||
rtl8192u | ||
rtl8712 | ||
rtl8821ae | ||
rts5139 | ||
rts5208 | ||
sb105x | ||
sbe-2t3e3 | ||
sep | ||
serqt_usb2 | ||
silicom | ||
slicoss | ||
sm7xxfb | ||
speakup | ||
ste_rmi4 | ||
tidspbridge | ||
usbip | ||
vme | ||
vt6655 | ||
vt6656 | ||
winbond | ||
wlags49_h2 | ||
wlags49_h25 | ||
wlan-ng | ||
xgifb | ||
xillybus | ||
Kconfig | ||
Makefile | ||
staging.c |