Patch "gpio: GPIO_GET_LINEHANDLE_IOCTL: Validate line offset" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

gpio: GPIO_GET_LINEHANDLE_IOCTL: Validate line offset

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
gpio-gpio_get_linehandle_ioctl-validate-line-offset.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Lars-Peter Clausen <[email protected]>
Date: Tue, 18 Oct 2016 16:54:01 +0200
Subject: gpio: GPIO_GET_LINEHANDLE_IOCTL: Validate line offset

From: Lars-Peter Clausen <[email protected]>

commit e405f9fcb63602d35f7a419ededa3f952a395a72 upstream.

The line offset that is used as an index into the descs array is provided by userspace and might go beyond the bounds of the array. If that happens undefined behavior will occur.

Make sure that the offset is within the bounds of the desc array and reject any requests that specify a value outside of it.

---
 drivers/gpio/gpiolib.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -442,6 +442,11 @@ static int linehandle_create(struct gpio
 		u32 lflags = handlereq.flags;
 		struct gpio_desc *desc;
 
+		if (offset >= gdev->ngpio) {
+			ret = -EINVAL;
+			goto out_free_descs;
+		}
+
 		desc = &gdev->descs[offset];
 		ret = gpiod_request(desc, lh->label);
 		if (ret)

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/gpio-gpio_get_chipinfo_ioctl-fix-line-offset-validation.patch queue-4.8/gpio-gpio_get_line-handle-event-_ioctl-fix-file-descriptor-leak.patch queue-4.8/gpio-gpio_get_chipinfo_ioctl-fix-information-leak.patch queue-4.8/gpio-gpio_get_lineevent_ioctl-reject-invalid-line-and-event-flags.patch queue-4.8/gpio-gpiohandle_get_line_values_ioctl-fix-another-information-leak.patch queue-4.8/gpio-gpio_get_linehandle_ioctl-reject-invalid-line-flags.patch queue-4.8/gpio-gpio_get_lineevent_ioctl-validate-line-offset.patch queue-4.8/gpio-gpiohandle_get_line_values_ioctl-fix-information-leak.patch queue-4.8/gpio-gpio_get_linehandle_ioctl-validate-line-offset.patch