From: Greg Kroah-Hartman Date: Fri, 24 Feb 2017 17:55:56 +0000 (+0100) Subject: remove usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch X-Git-Tag: v4.4.52~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9813ab33eb70a0c4564b996543d11d9beded33fe;p=thirdparty%2Fkernel%2Fstable-queue.git remove usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch --- diff --git a/queue-4.10/series b/queue-4.10/series index 90359297338..14e17904f2f 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -7,7 +7,6 @@ usb-serial-cp210x-add-new-ids-for-ge-bx50v3-boards.patch usb-serial-ftdi_sio-fix-modem-status-error-handling.patch usb-serial-ftdi_sio-fix-extreme-low-latency-setting.patch usb-serial-ftdi_sio-fix-line-status-over-reporting.patch -usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch usb-serial-spcp8x5-fix-modem-status-handling.patch usb-serial-opticon-fix-cts-retrieval-at-open.patch usb-serial-ark3116-fix-register-accessor-error-handling.patch diff --git a/queue-4.10/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch b/queue-4.10/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch deleted file mode 100644 index 22c2761720a..00000000000 --- a/queue-4.10/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 2d380889215fe20b8523345649dee0579821800c Mon Sep 17 00:00:00 2001 -From: Johan Hovold -Date: Tue, 31 Jan 2017 17:17:27 +0100 -Subject: USB: serial: digi_acceleport: fix OOB data sanity check - -From: Johan Hovold - -commit 2d380889215fe20b8523345649dee0579821800c upstream. - -Make sure to check for short transfers to avoid underflow in a loop -condition when parsing the receive buffer. - -Also fix an off-by-one error in the incomplete sanity check which could -lead to invalid data being parsed. - -Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32") -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reviewed-by: Greg Kroah-Hartman -Signed-off-by: Johan Hovold -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/usb/serial/digi_acceleport.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1482,16 +1482,20 @@ static int digi_read_oob_callback(struct - struct usb_serial *serial = port->serial; - struct tty_struct *tty; - struct digi_port *priv = usb_get_serial_port_data(port); -+ unsigned char *buf = urb->transfer_buffer; - int opcode, line, status, val; - int i; - unsigned int rts; - -+ if (urb->actual_length < 4) -+ return -1; -+ - /* handle each oob command */ -- for (i = 0; i < urb->actual_length - 3;) { -- opcode = ((unsigned char *)urb->transfer_buffer)[i++]; -- line = ((unsigned char *)urb->transfer_buffer)[i++]; -- status = ((unsigned char *)urb->transfer_buffer)[i++]; -- val = ((unsigned char *)urb->transfer_buffer)[i++]; -+ for (i = 0; i < urb->actual_length - 4; i += 4) { -+ opcode = buf[i]; -+ line = buf[i + 1]; -+ status = buf[i + 2]; -+ val = buf[i + 3]; - - dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n", - opcode, line, status, val); diff --git a/queue-4.4/series b/queue-4.4/series index 9d5a7d2d261..a55535f2252 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -14,7 +14,6 @@ usb-serial-cp210x-add-new-ids-for-ge-bx50v3-boards.patch usb-serial-ftdi_sio-fix-modem-status-error-handling.patch usb-serial-ftdi_sio-fix-extreme-low-latency-setting.patch usb-serial-ftdi_sio-fix-line-status-over-reporting.patch -usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch usb-serial-spcp8x5-fix-modem-status-handling.patch usb-serial-opticon-fix-cts-retrieval-at-open.patch usb-serial-ark3116-fix-register-accessor-error-handling.patch diff --git a/queue-4.4/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch b/queue-4.4/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch deleted file mode 100644 index bdef7a7b080..00000000000 --- a/queue-4.4/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 2d380889215fe20b8523345649dee0579821800c Mon Sep 17 00:00:00 2001 -From: Johan Hovold -Date: Tue, 31 Jan 2017 17:17:27 +0100 -Subject: USB: serial: digi_acceleport: fix OOB data sanity check - -From: Johan Hovold - -commit 2d380889215fe20b8523345649dee0579821800c upstream. - -Make sure to check for short transfers to avoid underflow in a loop -condition when parsing the receive buffer. - -Also fix an off-by-one error in the incomplete sanity check which could -lead to invalid data being parsed. - -Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32") -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reviewed-by: Greg Kroah-Hartman -Signed-off-by: Johan Hovold -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/usb/serial/digi_acceleport.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1483,16 +1483,20 @@ static int digi_read_oob_callback(struct - struct usb_serial *serial = port->serial; - struct tty_struct *tty; - struct digi_port *priv = usb_get_serial_port_data(port); -+ unsigned char *buf = urb->transfer_buffer; - int opcode, line, status, val; - int i; - unsigned int rts; - -+ if (urb->actual_length < 4) -+ return -1; -+ - /* handle each oob command */ -- for (i = 0; i < urb->actual_length - 3;) { -- opcode = ((unsigned char *)urb->transfer_buffer)[i++]; -- line = ((unsigned char *)urb->transfer_buffer)[i++]; -- status = ((unsigned char *)urb->transfer_buffer)[i++]; -- val = ((unsigned char *)urb->transfer_buffer)[i++]; -+ for (i = 0; i < urb->actual_length - 4; i += 4) { -+ opcode = buf[i]; -+ line = buf[i + 1]; -+ status = buf[i + 2]; -+ val = buf[i + 3]; - - dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n", - opcode, line, status, val); diff --git a/queue-4.9/series b/queue-4.9/series index 0e2df40a17c..7deebef35f0 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -18,7 +18,6 @@ usb-serial-cp210x-add-new-ids-for-ge-bx50v3-boards.patch usb-serial-ftdi_sio-fix-modem-status-error-handling.patch usb-serial-ftdi_sio-fix-extreme-low-latency-setting.patch usb-serial-ftdi_sio-fix-line-status-over-reporting.patch -usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch usb-serial-spcp8x5-fix-modem-status-handling.patch usb-serial-opticon-fix-cts-retrieval-at-open.patch usb-serial-ark3116-fix-register-accessor-error-handling.patch diff --git a/queue-4.9/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch b/queue-4.9/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch deleted file mode 100644 index 22c2761720a..00000000000 --- a/queue-4.9/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 2d380889215fe20b8523345649dee0579821800c Mon Sep 17 00:00:00 2001 -From: Johan Hovold -Date: Tue, 31 Jan 2017 17:17:27 +0100 -Subject: USB: serial: digi_acceleport: fix OOB data sanity check - -From: Johan Hovold - -commit 2d380889215fe20b8523345649dee0579821800c upstream. - -Make sure to check for short transfers to avoid underflow in a loop -condition when parsing the receive buffer. - -Also fix an off-by-one error in the incomplete sanity check which could -lead to invalid data being parsed. - -Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32") -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reviewed-by: Greg Kroah-Hartman -Signed-off-by: Johan Hovold -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/usb/serial/digi_acceleport.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1482,16 +1482,20 @@ static int digi_read_oob_callback(struct - struct usb_serial *serial = port->serial; - struct tty_struct *tty; - struct digi_port *priv = usb_get_serial_port_data(port); -+ unsigned char *buf = urb->transfer_buffer; - int opcode, line, status, val; - int i; - unsigned int rts; - -+ if (urb->actual_length < 4) -+ return -1; -+ - /* handle each oob command */ -- for (i = 0; i < urb->actual_length - 3;) { -- opcode = ((unsigned char *)urb->transfer_buffer)[i++]; -- line = ((unsigned char *)urb->transfer_buffer)[i++]; -- status = ((unsigned char *)urb->transfer_buffer)[i++]; -- val = ((unsigned char *)urb->transfer_buffer)[i++]; -+ for (i = 0; i < urb->actual_length - 4; i += 4) { -+ opcode = buf[i]; -+ line = buf[i + 1]; -+ status = buf[i + 2]; -+ val = buf[i + 3]; - - dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n", - opcode, line, status, val);