tmakin/ack-tegra
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
88a240d86d3d64521f9194abe185ac71cc74d0bd
ack-tegra/drivers
T
History
Tristan Madani 88a240d86d wifi: wcn36xx: fix heap overflow from oversized firmware HAL response 
The firmware response dispatcher copies all synchronous HAL responses
into the 4096-byte hal_buf without validating the response length. A
response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow
with firmware-controlled content.

Add a bounds check on the response length.

Fixes: 8e84c25821 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-2-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06 08:46:27 -07:00
..
accel
accel/amdxdna: Remove mmap and export support for ubuf
2026-05-19 08:47:59 -07:00
accessibility
…
acpi
ACPI: button: Add missing device class clearing on probe failures
2026-05-25 09:52:34 +02:00
amba
…
android
rust: allow clippy::collapsible_if globally
2026-04-30 23:21:31 +02:00
ata
ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
2026-05-18 12:26:51 +02:00
atm
atm: solos-pci: Simplify initialisation of pci_device_id array
2026-05-05 18:05:21 -07:00
auxdisplay
auxdisplay: line-display: fix NULL dereference in linedisp_release
2026-03-27 09:54:31 +01:00
base
Merge tag 'driver-core-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
2026-05-23 07:49:05 -07:00
bcma
…
block
Merge tag 'mm-hotfixes-stable-2026-05-25-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-05-26 08:23:19 -07:00
bluetooth
Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
2026-05-27 16:44:02 -04:00
bus
Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-04-24 13:23:50 -07:00
cache
…
cdrom
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
2026-04-27 15:52:51 -06:00
cdx
…
char
Merge tag 'for-linus-7.1-2' of https://github.com/cminyard/linux-ipmi
2026-05-04 12:48:30 -07:00
clk
clk: rk808: fix OF node reference imbalance
2026-04-28 20:55:53 -07:00
clocksource
…
comedi
Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-04-24 13:23:50 -07:00
connector
…
counter
Merge tag 'v7.0-rc7' into char-misc-next
2026-04-06 09:04:53 +02:00
cpufreq
cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch
2026-05-26 12:39:28 +02:00
cpuidle
Merge tag 'powerpc-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
2026-04-14 17:10:15 -07:00
crypto
crypto: ccp - copy IV using skcipher ivsize
2026-04-16 17:37:03 +08:00
cxl
Merge tag 'cxl-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl
2026-04-17 15:52:58 -07:00
dax
Merge tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2026-04-21 14:12:01 -07:00
dca
…
devfreq
PM / devfreq: tegra30-devfreq: add support for Tegra114
2026-04-04 03:15:39 +09:00
dibs
dibs: Improve DIBS prompts and help texts
2026-05-18 16:53:53 -07:00
dio
…
dma
Merge tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
2026-04-17 10:29:01 -07:00
dma-buf
Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel
2026-04-24 11:44:52 -07:00
dpll
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-05-28 14:02:21 -07:00
edac
EDAC/versalnet: Fix device name memory leak
2026-05-05 14:49:48 +02:00
eisa
…
extcon
…
firewire
…
firmware
Merge tag 'loongarch-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
2026-05-23 09:13:00 -07:00
fpga
…
fsi
…
fwctl
fwctl: pds: Validate RPC input size before parsing
2026-05-19 10:44:32 -03:00
gnss
…
gpib
Merge tag 'v7.0-rc7' into char-misc-next
2026-04-06 09:04:53 +02:00
gpio
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-05-28 14:02:21 -07:00
gpu
drm/msm: Restore second parameter name in purge() and evict()
2026-05-24 10:31:24 -07:00
greybus
greybus: gb-beagleplay: bound bootloader receive buffering
2026-04-02 15:55:09 +02:00
hid
Merge tag 'hid-for-linus-2026052801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
2026-05-29 08:51:46 -07:00
hsi
HSI: omap_ssi_port: remove depends on ARM
2026-04-02 22:33:44 +02:00
hte
hte: tegra194: Add Tegra264 GTE support
2026-04-12 23:29:31 -07:00
hv
Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel
2026-04-24 11:44:52 -07:00
hwmon
hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
2026-05-21 07:00:39 -07:00
hwspinlock
hwspinlock: u8500: delete driver
2026-04-06 09:43:18 -05:00
hwtracing
Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-04-24 13:23:50 -07:00
i2c
i2c: smbus: fix a potential uninitialization bug
2026-05-19 12:43:08 +02:00
i3c
i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
2026-04-12 22:06:02 +02:00
idle
…
iio
Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-04-24 13:23:50 -07:00
infiniband
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-05-28 14:02:21 -07:00
input
Merge tag 'input-for-v7.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2026-04-22 18:36:40 -07:00
interconnect
Merge tag 'icc-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next
2026-04-07 10:06:50 +02:00
iommu
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
2026-05-28 09:07:12 +02:00
ipack
…
irqchip
irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path
2026-05-21 20:11:29 +02:00
leds
leds: class: Make led_remove_lookup() NULL-aware
2026-04-09 13:49:19 +01:00
macintosh
…
mailbox
mailbox: mailbox-test: make data_ready a per-instance variable
2026-04-18 13:10:14 -05:00
mcb
…
md
Merge tag 'for-7.1/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
2026-05-25 12:45:40 -07:00
media
media: rc: ttusbir: fix inverted error logic
2026-05-04 08:33:39 +02:00
memory
Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
2026-04-17 11:12:42 -07:00
memstick
…
message
…
mfd
Merge tag 'mfd-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
2026-04-20 11:31:01 -07:00
misc
Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-04-24 13:23:50 -07:00
mmc
mmc: sdhci-msm: Fix the wrapped key handling
2026-04-10 10:29:58 +02:00
most
most: usb: Use kzalloc_objs for endpoint address array
2026-04-02 17:06:09 +02:00
mtd
mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW
2026-04-27 15:08:04 +02:00
mux
Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-04-24 13:23:50 -07:00
net
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
2026-06-06 08:46:27 -07:00
nfc
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
2026-05-18 18:30:36 +02:00
ntb
Merge tag 'pci-v7.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2026-04-15 14:41:21 -07:00
nubus
…
nvdimm
Merge tag 'vfs-7.1-rc1.integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 10:40:26 -07:00
nvme
Merge tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-05-28 13:13:48 -07:00
nvmem
Merge tag 'v7.0-rc7' into char-misc-next
2026-04-06 09:04:53 +02:00
of
Merge tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock
2026-04-18 11:29:14 -07:00
opp
…
parisc
parisc: Fix IRQ leak in LASI driver
2026-05-04 11:48:12 +02:00
parport
parport: Remove completed item from to-do list
2026-04-02 17:05:56 +02:00
pci
Merge tag 'pci-v7.1-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2026-05-21 15:02:12 -07:00
pcmcia
Merge tag 'pcmcia-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux
2026-04-23 11:22:16 -07:00
peci
…
perf
Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2026-04-14 16:48:56 -07:00
phy
phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
2026-05-19 15:42:11 +05:30
pinctrl
pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11
2026-05-13 09:34:55 +02:00
platform
Merge tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
2026-05-22 15:45:26 -07:00
pmdomain
pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
2026-04-27 14:53:30 +02:00
pnp
…
power
Merge tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2026-04-19 08:47:40 -07:00
powercap
powercap: intel_rapl: Consolidate PL4 and PMU support flags into rapl_defaults
2026-04-01 16:03:05 +02:00
pps
pps: change pps_class to a const struct
2026-04-02 16:33:00 +02:00
ps3
…
ptp
ptp: vmw: Drop ptp_vmw_acpi_device
2026-05-14 16:50:09 -07:00
pwm
Merge tag 'pwm/fixes-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
2026-04-23 08:37:07 -07:00
rapidio
…
ras
…
regulator
regulator: tps65219: fix irq_data.rdev not being assigned
2026-05-18 10:52:24 +01:00
remoteproc
Merge tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
2026-04-17 14:18:55 -07:00
resctrl
arm_mpam: Check whether the config array is allocated before destroying it
2026-05-14 09:52:05 +01:00
reset
reset: eyeq: drop device_set_of_node_from_dev() done by parent
2026-04-28 19:03:50 -07:00
rpmsg
rpmsg: Constify buffer passed to send API
2026-04-06 09:37:51 -05:00
rtc
Merge tag 'rtc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
2026-04-25 16:39:03 -07:00
s390
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-05-28 14:02:21 -07:00
sbus
…
scsi
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2026-05-22 16:08:06 -07:00
sh
…
siox
…
slimbus
…
soc
Merge tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
2026-04-17 14:18:55 -07:00
soundwire
Merge tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
2026-04-17 10:16:53 -07:00
spi
Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
2026-05-22 13:19:41 -07:00
spmi
…
ssb
…
staging
Merge tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
2026-05-14 14:30:01 -07:00
target
scsi: target: tcm_loop: Fix NULL ptr dereference
2026-05-14 22:21:01 -04:00
tc
…
tee
Merge tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2026-04-16 20:34:34 -07:00
thermal
Merge tag 'bitmap-for-v7.1' of https://github.com/norov/linux
2026-04-14 08:55:18 -07:00
thunderbolt
Merge tag 'thunderbolt-for-v7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next
2026-04-10 13:10:28 +02:00
tty
Merge tag 'tty-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2026-04-19 08:44:41 -07:00
ufs
scsi: ufs: core: Fix bRefClkFreq write failure in HS-LSS mode
2026-04-21 20:58:06 -04:00
uio
uio: replace deprecated mmap hook with mmap_prepare in uio_info
2026-04-05 13:53:44 -07:00
usb
Merge tag 'usb-serial-7.1-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
2026-05-08 17:18:43 +02:00
vdpa
vdpa: use generic driver_override infrastructure
2026-04-04 00:47:50 +02:00
vfio
vfio/pci: Check BAR resources before exporting a DMABUF
2026-05-14 11:39:03 -06:00
vhost
vhost-net: wake queue of tun/tap after ptr_ring consume
2026-05-13 17:52:55 -07:00
video
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
2026-05-04 10:35:55 +02:00
virt
virt: sev-guest: Explicitly leak pages in unknown state
2026-05-20 18:03:17 -07:00
virtio
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
w1
w1: ds2490: drop redundant device reference
2026-04-03 10:55:12 +02:00
watchdog
watchdog: ni903x_wdt: Convert to a platform driver
2026-04-07 21:06:59 +02:00
xen
ACPI: PAD: xen: Check ACPI_COMPANION() against NULL
2026-05-12 19:01:37 +02:00
zorro
…
Kconfig
net: remove ISDN subsystem and Bluetooth CMTP
2026-04-23 10:24:02 -07:00
Makefile
net: remove ISDN subsystem and Bluetooth CMTP
2026-04-23 10:24:02 -07:00