From: Greg Kroah-Hartman Date: Thu, 21 Nov 2019 17:55:26 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v5.3.13~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e4044665bc09f7b65e5e73ed8648b2ce516060ac;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch --- diff --git a/queue-4.9/net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch b/queue-4.9/net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch new file mode 100644 index 00000000000..ba9cf91eef8 --- /dev/null +++ b/queue-4.9/net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch @@ -0,0 +1,35 @@ +From a56dcc6b455830776899ce3686735f1172e12243 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 13 Nov 2019 21:28:31 +0300 +Subject: net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() + +From: Dan Carpenter + +commit a56dcc6b455830776899ce3686735f1172e12243 upstream. + +This code is supposed to test for negative error codes and partial +reads, but because sizeof() is size_t (unsigned) type then negative +error codes are type promoted to high positive values and the condition +doesn't work as expected. + +Fixes: 332f989a3b00 ("CDC-NCM: handle incomplete transfer of MTU") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Nobuhiro Iwamatsu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ncm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -577,7 +577,7 @@ static void cdc_ncm_set_dgram_size(struc + err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE, + USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE, + 0, iface_no, &max_datagram_size, sizeof(max_datagram_size)); +- if (err < sizeof(max_datagram_size)) { ++ if (err != sizeof(max_datagram_size)) { + dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n"); + goto out; + } diff --git a/queue-4.9/series b/queue-4.9/series index 9adddeb47c7..fff5ff10b25 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -145,3 +145,4 @@ fuse-use-read_once-on-congestion_threshold-and-max_b.patch ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch memfd-use-radix_tree_deref_slot_protected-to-avoid-the-warning.patch slcan-fix-memory-leak-in-error-path.patch +net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch