superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/drivers
History
Ian Abbott ed93c6f68a comedi: das16m1: Fix bit shift out of bounds 
When checking for a supported IRQ number, the following test is used:

	/* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */
	if ((1 << it->options[1]) & 0xdcfc) {

However, `it->options[i]` is an unchecked `int` value from userspace, so
the shift amount could be negative or out of bounds.  Fix the test by
requiring `it->options[1]` to be within bounds before proceeding with
the original test.

Reported-by: syzbot+c52293513298e0fd9a94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c52293513298e0fd9a94
Fixes: 7299885076 ("staging: comedi: das16m1: tidy up the irq support in das16m1_attach()")
Tested-by: syzbot+c52293513298e0fd9a94@syzkaller.appspotmail.com
Suggested-by: "Enju, Kohei" <enjuk@amazon.co.jp>
Cc: stable@vger.kernel.org # 5.13+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20250707130908.70758-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2025-07-16 15:02:26 +02:00
..
accel accel/amdxdna: Fix incorrect PSP firmware size 2025-06-09 07:16:32 -07:00
accessibility
…
acpi ACPICA: Refuse to evaluate a method if arguments are missing 2025-06-18 21:12:13 +02:00
amba
…
android Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
ata ata: ahci: Disallow LPM for Asus B550-F motherboard 2025-06-17 11:11:39 +02:00
atm atm: atmtcp: Free invalid length skb in atmtcp_c_send(). 2025-06-17 18:42:44 -07:00
auxdisplay treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
base driver core: faux: Quiet probe failures 2025-06-10 19:23:25 +02:00
bcma
…
block block-6.16-20250619 2025-06-19 23:29:35 -07:00
bluetooth Including fixes from bluetooth and wireless. 2025-06-12 09:50:36 -07:00
bus treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cache
…
cdrom
…
cdx
…
char treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
clk I've recently moved computers (among other things) so I'm sending this from a 2025-05-30 09:15:40 -07:00
clocksource MFD for v6.16 2025-06-03 11:53:55 -07:00
comedi comedi: das16m1: Fix bit shift out of bounds 2025-07-16 15:02:26 +02:00
connector
…
counter Second set of Counter updates for 6.16 2025-05-24 08:29:32 +02:00
cpufreq rust: Use CpuId in place of raw CPU numbers 2025-06-12 10:31:28 +05:30
cpuidle Merge branch 'pm-cpuidle' 2025-05-30 20:21:36 +02:00
crypto treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cxl Merge branch 'for-6.16/cxl-features-ras' into cxl-for-next 2025-05-23 13:26:24 -07:00
dax
…
dca
…
devfreq
…
dio
…
dma treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
dma-buf udmabuf: use sgtable-based scatterlist wrappers 2025-06-11 13:18:07 +02:00
dpll
…
edac EDAC/igen6: Fix NULL pointer dereference 2025-06-18 20:19:45 +02:00
eisa
…
extcon
…
firewire treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
firmware Kbuild updates for v6.16 2025-06-07 10:05:35 -07:00
fpga FPGA Manager changes for 6.16-rc1 2025-05-21 14:08:44 +02:00
fsi
…
fwctl
…
gnss
…
gpio gpio: mlxbf3: only get IRQ for device instance 0 2025-06-18 12:19:39 +02:00
gpu Driver Changes: 2025-06-20 09:01:51 +10:00
greybus treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hid treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hsi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hte
…
hv hyperv-next for v6.16 2025-06-03 08:39:20 -07:00
hwmon hwmon: (ltc4282) avoid repeated register write 2025-06-16 06:30:58 -07:00
hwspinlock
…
hwtracing coresight: updates for Linux v6.16 2025-05-22 18:04:43 +02:00
i2c i2c: k1: check for transfer error 2025-06-21 22:17:02 +02:00
i3c i3c: controllers do not need to depend on I3C 2025-05-24 22:49:07 +02:00
idle intel_idle: Update arguments of mwait_idle_with_hints() 2025-06-10 21:09:28 +02:00
iio iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode 2025-06-29 17:15:40 +01:00
infiniband treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
input treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
interconnect interconnect: avoid memory allocation when 'icc_bw_lock' is held 2025-06-27 21:43:40 +03:00
iommu iommu/tegra: Fix incorrect size calculation 2025-06-13 17:02:31 +02:00
ipack
…
irqchip irqchip/ath79-misc: Fix missing prototypes warnings 2025-06-20 21:38:52 +02:00
isdn treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
leds treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
macintosh
…
mailbox treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mcb
…
md treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
media treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
memory treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
memstick treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
message
…
mfd MFD for v6.16 2025-06-03 11:53:55 -07:00
misc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mmc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
most treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mtd mtd: spinand: fix memory leak of ECC engine conf 2025-06-19 19:13:21 +02:00
mux mux: mmio: Fix missing CONFIG_REGMAP_MMIO 2025-07-04 16:27:08 +02:00
net net: airoha: Differentiate hwfd buffer size for QDMA0 and QDMA1 2025-06-19 08:41:59 -07:00
nfc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ntb
…
nubus
…
nvdimm
…
nvme block-6.16-20250614 2025-06-14 09:25:22 -07:00
nvmem nvmem: imx-ocotp: fix MAC address byte length 2025-07-13 17:43:13 +02:00
of - The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox 2025-05-31 15:44:16 -07:00
opp
…
parisc
…
parport treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
pci PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC 2025-06-18 10:10:19 -05:00
pcmcia treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
peci
…
perf arm64 updates for 6.16 2025-05-28 14:55:35 -07:00
phy phy-for-6.16 2025-06-05 08:20:21 -07:00
pinctrl pinctrl: sunxi: dt: Consider pin base when calculating bank number from pin 2025-06-10 14:35:40 +02:00
platform Revert "platform/x86: alienware-wmi-wmax: Add G-Mode support to Alienware m16 R1" 2025-06-13 15:09:02 +03:00
pmdomain
…
pnp
…
power - The 3 patch series "hung_task: extend blocking task stacktrace dump to 2025-05-31 19:12:53 -07:00
powercap
…
pps treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ps3
…
ptp ptp: allow reading of currently dialed frequency to succeed on free-running clocks 2025-06-17 16:13:09 -07:00
pwm pwm: axi-pwmgen: Fix handling of external clock 2025-06-06 13:16:50 -07:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-11 22:42:36 -07:00
ras
…
regulator regulator: fan53555: add enable_time support and soft-start times 2025-06-16 13:26:23 +01:00
remoteproc remoteproc updates for v6.16 2025-06-02 11:04:29 -07:00
reset
…
rpmsg
…
rtc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
s390 Merge branch '6.16/scsi-queue' into 6.16/scsi-fixes 2025-06-09 15:34:06 -04:00
sbus
…
scsi scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() 2025-06-16 17:52:05 -04:00
sh
…
siox
…
slimbus
…
soc soc: drivers for 6.16 2025-05-31 07:53:30 -07:00
soundwire soundwire updates for 6.16 2025-06-05 08:07:24 -07:00
spi spi: tegra210-qspi: Remove cache operations 2025-06-13 17:30:56 +01:00
spmi irqdomain: spmi: Switch to irq_domain_create_tree() 2025-05-21 14:53:17 +02:00
ssb
…
staging treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
target scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() 2025-06-16 14:35:57 -04:00
tc
…
tee
…
thermal Thermal control updates for 6.16-rc1 2025-05-27 16:28:02 -07:00
thunderbolt
…
tty treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ufs Merge branch '6.16/scsi-queue' into 6.16/scsi-fixes 2025-06-09 15:34:06 -04:00
uio Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
usb treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
vdpa vdpa/octeon_ep: Control PCI dev enabling manually 2025-05-27 10:27:53 -04:00
vfio pci-v6.16-changes 2025-06-04 11:26:17 -07:00
vhost virtio, vhost: features, fixes 2025-05-29 08:15:35 -07:00
video treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
virt treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
virtio virtio_rtc: Add RTC class driver 2025-05-27 10:27:54 -04:00
w1 Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
watchdog treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
xen xen/x86: fix initial memory balloon target 2025-05-23 07:09:00 +02:00
zorro
…
Kconfig
…
Makefile
…