Johan Hovold 04d6387f6f USB: whiteheat: fix potential null-deref at probe ... commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream. Fix potential null-pointer dereference at probe by making sure that the required endpoints are present. The whiteheat driver assumes there are at least five pairs of bulk endpoints, of which the final pair is used for the "command port". An attempt to bind to an interface with fewer bulk endpoints would currently lead to an oops. Fixes CVE-2015-5257. Reported-by: Moein Ghasemzadeh <moein@istuary.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Zefan Li <lizefan@huawei.com>		2016-03-21 09:17:54 +08:00
..
accessibility
acpi	ACPICA: Tables: Fix an issue that FACS initialization is performed twice	2015-10-22 09:20:07 +08:00
amba
ata	libata: increase the timeout when setting transfer mode	2016-03-21 09:17:45 +08:00
atm
auxdisplay
base	regmap: Fix regmap_bulk_read in BE mode	2015-10-22 09:20:04 +08:00
bcma
block	nbd: fix possible memory leak	2015-06-19 11:40:28 +08:00
bluetooth	ath3k: add support of 13d3:3474 AR3012 device	2015-10-22 09:20:03 +08:00
cdrom
char	agp/intel: Fix typo in needs_ilk_vtd_wa()	2015-10-22 09:20:06 +08:00
clk
clocksource
connector
cpufreq	cpufreq: speedstep-smi: enable interrupts when waiting	2015-06-19 11:40:15 +08:00
cpuidle
crypto	crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer	2016-03-21 09:17:48 +08:00
dca
devfreq
dio
dma	dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup	2015-10-22 09:20:04 +08:00
edac	EDAC, ppc4xx: Access mci->csrows array elements properly	2016-03-21 09:17:52 +08:00
eisa
firewire
firmware
gpio	gpio: tps65912: fix wrong container_of arguments	2015-06-19 11:40:18 +08:00
gpu	drm/radeon/combios: add some validation of lvds values	2016-03-21 09:17:49 +08:00
hid	HID: roccat: potential out of bounds in pyra_sysfs_write_settings()	2015-04-14 17:33:52 +08:00
hsi
hv	Drivers: hv: vmbus: Don't wait after requesting offers	2015-09-18 09:20:26 +08:00
hwmon
hwspinlock
i2c
ide
idle
ieee802154
infiniband	IB/qib: Change lkey table allocation to support more MRs	2015-10-22 09:20:08 +08:00
input	Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen	2016-03-21 09:17:47 +08:00
iommu
isdn	ppp, slip: Validate VJ compression slot parameters completely	2016-03-21 09:17:54 +08:00
leds
lguest	lguest: fix out-by-one error in address checking.	2015-09-18 09:20:43 +08:00
macintosh
mca
md	dm btree: add ref counting ops for the leaves of top level btrees	2016-03-21 09:17:52 +08:00
media
memstick	memstick: mspro_block: add missing curly braces	2015-09-18 09:20:31 +08:00
message
mfd
misc
mmc	mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()	2016-03-21 09:17:48 +08:00
mtd	mtd: dc21285: use raw spinlock functions for nw_gpio_lock	2015-10-22 09:20:02 +08:00
net	ppp, slip: Validate VJ compression slot parameters completely	2016-03-21 09:17:54 +08:00
nfc
nubus
of
oprofile
parisc
parport
pci	PCI: Convert pcibios_resource_to_bus() to take a pci_bus, not a pci_dev	2015-06-19 11:40:34 +08:00
pcmcia	Disable write buffering on Toshiba ToPIC95	2015-10-22 09:20:04 +08:00
pinctrl
platform	dell-laptop: Fix allocating & freeing SMI buffer page	2015-10-22 09:20:06 +08:00
pnp
power
pps
ps3
ptp
rapidio
regulator	regulator: core: fix constraints output buffer	2015-10-22 09:20:03 +08:00
remoteproc
rpmsg
rtc
s390	s390/3215: fix tty output containing tabs	2015-04-14 17:34:03 +08:00
sbus
scsi	sg_start_req(): make sure that there's not too many elements in iovec	2016-03-21 09:17:54 +08:00
sfi
sh
sn
spi	spi: spidev: fix possible arithmetic overflow for multi-transfer message	2015-06-19 11:40:32 +08:00
ssb
staging	staging: rtl8712: prevent buffer overrun in recvbuf2recvframe	2015-10-22 09:20:02 +08:00
target	target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT	2016-03-21 09:17:49 +08:00
tc
thermal
tty	tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send	2015-10-22 09:20:02 +08:00
uio
usb	USB: whiteheat: fix potential null-deref at probe	2016-03-21 09:17:54 +08:00
uwb
vhost	vhost: actually track log eventfd file	2016-03-21 09:17:49 +08:00
video	PCI: Convert pcibios_resource_to_bus() to take a pci_bus, not a pci_dev	2015-06-19 11:40:34 +08:00
virt
virtio	virtio_pci: document why we defer kfree	2015-04-14 17:33:50 +08:00
vlynq
w1
watchdog	watchdog: omap: assert the counter being stopped before reprogramming	2015-10-22 09:20:06 +08:00
xen	xen/events: don't bind non-percpu VIRQs with percpu chip	2015-09-18 09:20:42 +08:00
zorro
Kconfig
Makefile