From: ChiYuan Huang <cy_huang(a)richtek.com>
Fix the potential risk for null pointer if bank index is over the maximimum.
Refer to the discussion list for the experiment result on mt6370.
https://lore.kernel.org/all/20220914013345.GA5802@cyhuang-hp-elitebook-840-…
If not to check the bound, there is the same issue on mt6360.
Fixes: 3b0850440a06c (mfd: mt6360: Merge different sub-devices I2C read/write)
Cc: stable(a)vger.kernel.org
Signed-off-by: ChiYuan Huang <cy_huang(a)richtek.com>
---
drivers/mfd/mt6360-core.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mfd/mt6360-core.c b/drivers/mfd/mt6360-core.c
index 6eaa677..d375333 100644
--- a/drivers/mfd/mt6360-core.c
+++ b/drivers/mfd/mt6360-core.c
@@ -410,6 +410,9 @@ static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size,
u8 crc;
int ret;
+ if (bank >= MT6360_SLAVE_MAX)
+ return -EINVAL;
+
if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) {
crc_needed = true;
ret = mt6360_xlate_pmicldo_addr(®_addr, val_size);
@@ -460,6 +463,9 @@ static int mt6360_regmap_write(void *context, const void *val, size_t val_size)
int write_size = val_size - MT6360_REGMAP_REG_BYTE_SIZE;
int ret;
+ if (bank >= MT6360_SLAVE_MAX)
+ return -EINVAL;
+
if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) {
crc_needed = true;
ret = mt6360_xlate_pmicldo_addr(®_addr, val_size - MT6360_REGMAP_REG_BYTE_SIZE);
--
2.7.4
This is the start of the stable review cycle for the 4.9.330 release.
There are 21 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Sep 2022 16:35:25 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.330-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.330-rc2
Jan Kara <jack(a)suse.cz>
ext4: make directory inode spreading reflect flexbg size
Vitaly Kuznetsov <vkuznets(a)redhat.com>
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
Stefan Haberland <sth(a)linux.ibm.com>
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
serial: Create uart_xmit_advance()
Sean Anderson <seanga2(a)gmail.com>
net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
Adrian Hunter <adrian.hunter(a)intel.com>
perf kcore_copy: Do not check /proc/modules is unchanged
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: gs_usb: gs_can_open(): fix race dev->can.state condition
Randy Dunlap <rdunlap(a)infradead.org>
MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko
Benjamin Poirier <bpoirier(a)nvidia.com>
net: team: Unsync device addresses on ndo_stop
Lu Wei <luwei32(a)huawei.com>
ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
David Leadbeater <dgl(a)dgl.cx>
netfilter: nf_conntrack_irc: Tighten matching on DCC message
Igor Ryzhov <iryzhov(a)nfware.com>
netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
Chao Yu <chao.yu(a)oppo.com>
mm/slub: fix to return errno if kmalloc() fails
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: add Intel 5 Series / 3400 PCI DID
Mohan Kumar <mkumard(a)nvidia.com>
ALSA: hda/tegra: set depop delay for tegra
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Fix RST error in hub.c
Siddh Raman Pant <code(a)siddh.me>
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
Hyunwoo Kim <imv4bel(a)gmail.com>
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
Stefan Metzmacher <metze(a)samba.org>
cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
Yang Yingliang <yangyingliang(a)huawei.com>
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
-------------
Diffstat:
Makefile | 4 ++--
arch/mips/lantiq/clk.c | 1 +
drivers/hv/vmbus_drv.c | 10 +++++++++-
drivers/net/can/usb/gs_usb.c | 4 ++--
drivers/net/ethernet/sun/sunhme.c | 4 ++--
drivers/net/ipvlan/ipvlan_core.c | 6 ++++--
drivers/net/team/team.c | 24 ++++++++++++++++++------
drivers/parisc/ccio-dma.c | 1 +
drivers/s390/block/dasd_alias.c | 9 +++++++--
drivers/tty/serial/serial-tegra.c | 5 ++---
drivers/usb/core/hub.c | 2 +-
drivers/video/fbdev/pxa3xx-gcu.c | 2 +-
fs/cifs/transport.c | 4 ++--
fs/ext4/ialloc.c | 2 +-
include/linux/serial_core.h | 17 +++++++++++++++++
mm/slub.c | 5 ++++-
net/mac80211/scan.c | 11 +++++++----
net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++++------
net/netfilter/nf_conntrack_sip.c | 4 ++--
sound/pci/hda/hda_intel.c | 2 ++
sound/pci/hda/patch_hdmi.c | 1 +
tools/perf/util/symbol-elf.c | 7 ++-----
22 files changed, 116 insertions(+), 43 deletions(-)