Andrew Morton 1921781ec4 drivers/rapidio/rio_cm.c: prevent possible heap overwrite ... commit 50695153d7 upstream. In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace. Reported-by: maher azz <maherazz04@gmail.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: Alexandre Bounine <alex.bou9@gmail.com> Cc: Linus Torvalds <torvalds@linuxfoundation.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-06-27 11:08:58 +01:00
..
devices	rapidio: fix an API misues when rio_add_net() fails	2025-03-13 12:58:27 +01:00
switches
Kconfig
Makefile
rio_cm.c	drivers/rapidio/rio_cm.c: prevent possible heap overwrite	2025-06-27 11:08:58 +01:00
rio-access.c
rio-driver.c
rio-scan.c
rio-sysfs.c
rio.c
rio.h