Johan Hovold cf20c3533e misc: fastrpc: fix memory corruption on open ...

commit d245f43aab upstream.

The probe session-duplication overflow check incremented the session
count also when there were no more available sessions so that memory
beyond the fixed-size slab-allocated session array could be corrupted in
fastrpc_session_alloc() on open().

Fixes: f6f9279f2b ("misc: fastrpc: Add Qualcomm fastrpc basic driver model")
Cc: stable@vger.kernel.org      # 5.1
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20220829080531.29681-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2022-09-08 12:28:04 +02:00

..

altera-stapl

altera-stapl: remove the unreached switch case

2020-12-09 19:53:03 +01:00

bcm-vk

misc: bcm-vk: fix tty registration race

2021-09-21 16:17:15 +02:00

c2port

misc: c2port: core: Make copying name from userspace more secure

2020-11-03 10:12:10 +01:00

cardreader

misc: rtsx: Fix an error handling path in rtsx_pci_probe()

2022-08-17 14:23:45 +02:00

cb710

cb710: avoid NULL pointer subtraction

2021-10-05 15:50:05 +02:00

cxl

cxl: Fix a memory leak in an error handling path

2022-08-25 11:40:36 +02:00

echo

char: Replace HTTP links with HTTPS ones

2020-07-23 09:44:15 +02:00

eeprom

eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()

2022-08-17 14:23:52 +02:00

genwqe

misc: genwqe: Fixes DMA mask setting

2021-09-14 10:45:41 +02:00

habanalabs

habanalabs/gaudi: mask constant value before cast

2022-08-25 11:40:36 +02:00

ibmasm

Merge tag 'char-misc-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2021-07-05 13:42:16 -07:00

lis3lv02d

platform/x86: hp_accel: Remove _INI method call

2021-08-26 15:09:18 +02:00

lkdtm

lkdtm/usercopy: Expand size of "out of frame" object

2022-06-14 18:36:20 +02:00

mei

mei: me: add raptor lake point S DID

2022-06-22 14:22:03 +02:00

ocxl

misc: ocxl: fix possible double free in ocxl_file_register_afu

2022-06-09 10:23:06 +02:00

pvpanic

misc/pvpanic: Convert regular spinlock into trylock on panic path

2022-06-14 18:36:06 +02:00

sgi-gru

misc: sgi-gru: Convert from atomic_t to refcount_t on gru_thread_state->ts_refcnt

2021-07-21 13:50:54 +02:00

sgi-xp

sgi-xpc: Replace deprecated CPU-hotplug functions.

2021-08-03 16:30:36 +02:00

ti-st

ti-st: use tty_write_room

2021-05-13 17:03:20 +02:00

uacce

uacce: Handle parent device removal or parent driver module rmmod

2022-08-25 11:40:34 +02:00

vmw_vmci

VMCI: fix NULL pointer dereference when unmapping queue pair

2021-08-27 16:21:59 +02:00

ad525x_dpot-i2c.c

…

ad525x_dpot-spi.c

…

ad525x_dpot.c

drivers: misc: ad525x_dpot: Add missing check in dpot_read_spi

2021-03-10 09:21:02 +01:00

ad525x_dpot.h

…

apds990x.c

…

apds9802als.c

…

atmel-ssc.c

misc: atmel-ssc: Fix IRQ check in ssc_probe

2022-06-22 14:22:00 +02:00

bh1770glc.c

…

cs5535-mfgpt.c

…

ds1682.c

…

dummy-irq.c

…

dw-xdata-pcie.c

misc: Add Synopsys DesignWare xData IP driver

2021-04-05 13:15:52 +02:00

enclosure.c

misc: enclosure: Update enclosure_remove_device() documentation to match reality

2020-07-01 15:05:37 +02:00

fastrpc.c

misc: fastrpc: fix memory corruption on open

2022-09-08 12:28:04 +02:00

gehc-achc.c

misc: gehc: Add SPI ID table

2021-10-05 15:47:18 +02:00

hi6421v600-irq.c

staging: hikey9xx: split hi6421v600 irq into a separate driver

2021-07-21 11:24:43 +02:00

hisi_hikey_usb.c

misc: hisi_hikey_usb: use PTR_ERR_OR_ZERO

2020-10-29 08:37:29 +01:00

hmc6352.c

…

hpilo.c

misc: hpilo: map iLO shared memory by PCI revision id

2021-06-04 15:28:23 +02:00

hpilo.h

misc: hpilo: map iLO shared memory by PCI revision id

2021-06-04 15:28:23 +02:00

ibmvmc.c

vio: make remove callback return void

2021-03-02 22:41:23 +11:00

ibmvmc.h

…

ics932s401.c

ics932s401: fix broken handling of errors when word reading fails

2021-05-13 17:21:54 +02:00

isl29003.c

misc: isl29003: Fix typo for get/set mode

2020-12-09 19:35:34 +01:00

isl29020.c

…

Kconfig

misc: HI6421V600_IRQ should depend on HAS_IOMEM

2021-10-05 16:07:56 +02:00

kgdbts.c

kgdbts: fix return value of __setup handler

2022-04-08 14:23:50 +02:00

lattice-ecp3-config.c

misc: lattice-ecp3-config: Fix task hung when firmware load failed

2022-01-27 11:04:17 +01:00

Makefile

Merge tag 'staging-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2021-09-01 09:45:57 -07:00

pch_phub.c

misc: pch_phub: Remove superfluous descriptions to non-existent args 'offset_address'

2020-07-01 15:05:37 +02:00

pci_endpoint_test.c

Merge tag 'pci-v5.15-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

2021-09-07 19:13:42 -07:00

phantom.c

misc/phantom.c: use generic power management

2020-06-29 18:43:42 +02:00

qcom-coincell.c

…

sram-exec.c

char: Replace HTTP links with HTTPS ones

2020-07-23 09:44:15 +02:00

sram.c

misc: sram: Only map reserved areas in Tegra SYSRAM

2021-08-05 14:27:46 +02:00

sram.h

misc: sram: Only map reserved areas in Tegra SYSRAM

2021-08-05 14:27:46 +02:00

tifm_7xx1.c

misc/tifm_7xx1.c: use generic power management

2020-06-29 18:43:42 +02:00

tifm_core.c

bus: Make remove callback return void

2021-07-21 11:53:42 +02:00

tsl2550.c

…

vmw_balloon.c

drivers: vmw_balloon: remove dentry pointer for debugfs

2021-03-10 09:21:02 +01:00

xilinx_sdfec.c

misc: xilinx-sdfec: Drop unnecessary NULL check after container_of

2021-05-21 22:14:48 +02:00