commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream. The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream. The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics - fix touchpad not working after S2R on Vostro V13 Input: cma3000_d0x - fix signedness bug in cma3000_thread_irq() Input: wacom - add product id used by Samsung Slate 7
The error check (intr_status < 0) didn't work because intr_status is a u8. Change its type to signed int. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
* 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
Revert "tracing: Include module.h in define_trace.h"
irq: don't put module.h into irq.h for tracking irqgen modules.
bluetooth: macroize two small inlines to avoid module.h
ip_vs.h: fix implicit use of module_get/module_put from module.h
nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
include: replace linux/module.h with "struct module" wherever possible
include: convert various register fcns to macros to avoid include chaining
crypto.h: remove unused crypto_tfm_alg_modname() inline
uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
pm_runtime.h: explicitly requires notifier.h
linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
miscdevice.h: fix up implicit use of lists and types
stop_machine.h: fix implicit use of smp.h for smp_processor_id
of: fix implicit use of errno.h in include/linux/of.h
of_platform.h: delete needless include <linux/module.h>
acpi: remove module.h include from platform/aclinux.h
miscdevice.h: delete unnecessary inclusion of module.h
device_cgroup.h: delete needless include <linux/module.h>
net: sch_generic remove redundant use of <linux/module.h>
net: inet_timewait_sock doesnt need <linux/module.h>
...
Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in
- drivers/media/dvb/frontends/dibx000_common.c
- drivers/media/video/{mt9m111.c,ov6650.c}
- drivers/mfd/ab3550-core.c
- include/linux/dmaengine.h
* 'for-next' of git://git.infradead.org/users/sameo/mfd-2.6: (80 commits) mfd: Fix missing abx500 header file updates mfd: Add missing <linux/io.h> include to intel_msic x86, mrst: add platform support for MSIC MFD driver mfd: Expose TurnOnStatus in ab8500 sysfs mfd: Remove support for early drop ab8500 chip mfd: Add support for ab8500 v3.3 mfd: Add ab8500 interrupt disable hook mfd: Convert db8500-prcmu panic() into pr_crit() mfd: Refactor db8500-prcmu request_clock() function mfd: Rename db8500-prcmu init function mfd: Fix db5500-prcmu defines mfd: db8500-prcmu voltage domain consumers additions mfd: db8500-prcmu reset code retrieval mfd: db8500-prcmu tweak for modem wakeup mfd: Add db8500-pcmu watchdog accessor functions for watchdog mfd: hwacc power state db8500-prcmu accessor mfd: Add db8500-prcmu accessors for PLL and SGA clock mfd: Move to the new db500 PRCMU API mfd: Create a common interface for dbx500 PRCMU drivers mfd: Initialize DB8500 PRCMU regs ... Fix up trivial conflicts in arch/arm/mach-imx/mach-mx31moboard.c arch/arm/mach-omap2/board-omap3beagle.c arch/arm/mach-u300/include/mach/irqs.h drivers/mfd/wm831x-spi.c
A pending cleanup will mean that module.h won't be implicitly everywhere anymore. Make sure the modular drivers in input dir are actually calling out for <module.h> explicitly in advance. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (348 commits) [media] pctv452e: Remove bogus code [media] adv7175: Make use of media bus pixel codes [media] media: vb2: fix incorrect return value [media] em28xx: implement VIDIOC_ENUM_FRAMESIZES [media] cx23885: Stop the risc video fifo before reconfiguring it [media] cx23885: Avoid incorrect error handling and reporting [media] cx23885: Avoid stopping the risc engine during buffer timeout [media] cx23885: Removed a spurious function cx23885_set_scale() [media] cx23885: v4l2 api compliance, set the audioset field correctly [media] cx23885: hook the audio selection functions into the main driver [media] cx23885: add generic functions for dealing with audio input selection [media] cx23885: fixes related to maximum number of inputs and range checking [media] cx23885: Initial support for the MPX-885 mini-card [media] cx25840: Ensure AUDIO6 and AUDIO7 trigger line-in baseband use [media] cx23885: Enable audio line in support from the back panel [media] cx23885: Allow the audio mux config to be specified on a per input basis [media] cx25840: Enable support for non-tuner LR1/LR2 audio inputs [media] cx23885: Name an internal i2c part and declare a bitfield by name [media] cx23885: Ensure VBI buffers timeout quickly - bugfix for vbi hangs during streaming [media] cx23885: remove channel dump diagnostics when a vbi buffer times out ... Fix up trivial conflicts in drivers/misc/altera-stapl/altera.c (header file rename vs add)
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (549 commits) ALSA: hda - Fix ADC input-amp handling for Cx20549 codec ALSA: hda - Keep EAPD turned on for old Conexant chips ALSA: hda/realtek - Fix missing volume controls with ALC260 ASoC: wm8940: Properly set codec->dapm.bias_level ALSA: hda - Fix pin-config for ASUS W90V ALSA: hda - Fix surround/CLFE headphone and speaker pins order ALSA: hda - Fix typo ALSA: Update the sound git tree URL ALSA: HDA: Add new revision for ALC662 ASoC: max98095: Convert codec->hw_write to snd_soc_write ASoC: keep pointer to resource so it can be freed ASoC: sgtl5000: Fix wrong mask in some snd_soc_update_bits calls ASoC: wm8996: Fix wrong mask for setting WM8996_AIF_CLOCKING_2 ASoC: da7210: Add support for line out and DAC ASoC: da7210: Add support for DAPM ALSA: hda/realtek - Fix DAC assignments of multiple speakers ASoC: Use SGTL5000_LINREG_VDDD_MASK instead of hardcoded mask value ASoC: Set sgtl5000->ldo in ldo_regulator_register ASoC: wm8996: Use SND_SOC_DAPM_AIF_OUT for AIF2 Capture ASoC: wm8994: Use SND_SOC_DAPM_AIF_OUT for AIF3 Capture ...
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (68 commits) Input: adp5589-keys - add support for the ADP5585 derivatives Input: imx_keypad - add pm suspend and resume support Input: force feedback - potential integer wrap in input_ff_create() Input: tsc2007 - make sure that X plate resistance is specified Input: serio_raw - fix memory leak when closing char device Input: serio_raw - kick clients when disconnecting port Input: serio_raw - explicitly mark disconnected ports as dead Input: serio_raw - fix coding style issues Input: serio_raw - use dev_*() for messages Input: serio_raw - use bool for boolean data Input: serio_raw - perform proper locking when adding clients to list Input: serio_raw - rename serio_raw_list to serio_raw_client Input: serio_raw - use kref instead of rolling out its own refcounting Input: psmouse - switch to using dev_*() for messages Input: wacom - correct max Y value on medium bamboos Input: wacom - add ABS_DISTANCE to Bamboo Pen reports Input: wacom - remove unneeded touch pressure initialization Input: lm8323 - wrap suspend and resume in CONFIG_PM_SLEEP Input: ad7879-i2c - wrap suspend and resume in CONFIG_PM_SLEEP Input: synaptics_i2c - wrap suspend and resume in CONFIG_PM_SLEEP ...