From: Sasha Levin Date: Wed, 30 Oct 2019 11:28:35 +0000 (-0400) Subject: fixes for 4.4 X-Git-Tag: v4.4.199~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bf0d6892ea52eb88c45df0f28eb71f308d5775a8;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/series b/queue-4.4/series index c6d9cdf6634..c7884ee8a9b 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -19,3 +19,4 @@ fs-ocfs2-fix-a-possible-null-pointer-dereference-in-.patch mips-fw-sni-fix-out-of-bounds-init-of-o32-stack.patch nfsv4-fix-leak-of-clp-cl_acceptor-string.patch tracing-initialize-iter-seq-after-zeroing-in-tracing.patch +usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch diff --git a/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch new file mode 100644 index 00000000000..4b3a0615f4b --- /dev/null +++ b/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch @@ -0,0 +1,39 @@ +From beea3ba2e329e5f30ecb64bc81f0e008cd450f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 17:11:15 +0300 +Subject: USB: legousbtower: fix a signedness bug in tower_probe() + +From: Dan Carpenter + +[ Upstream commit fd47a417e75e2506eb3672ae569b1c87e3774155 ] + +The problem is that sizeof() is unsigned long so negative error codes +are type promoted to high positive values and the condition becomes +false. + +Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe") +Signed-off-by: Dan Carpenter +Acked-by: Johan Hovold +Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/legousbtower.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c +index 32b41eb07f00e..8350ecfbcf21a 100644 +--- a/drivers/usb/misc/legousbtower.c ++++ b/drivers/usb/misc/legousbtower.c +@@ -910,7 +910,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device + get_version_reply, + sizeof(*get_version_reply), + 1000); +- if (result < sizeof(*get_version_reply)) { ++ if (result != sizeof(*get_version_reply)) { + if (result >= 0) + result = -EIO; + dev_err(idev, "get version request failed: %d\n", result); +-- +2.20.1 +