From f0950d49098a499810a200310a9064d13700e3e3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 7 Jun 2016 17:26:04 -0700 Subject: [PATCH] remove queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch --- queue-4.4/series | 1 - ...ion-fix-overflow-of-interfaces-array.patch | 40 ------------------- 2 files changed, 41 deletions(-) delete mode 100644 queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch diff --git a/queue-4.4/series b/queue-4.4/series index 8217437f660..3eece183c3f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -60,7 +60,6 @@ media-v4l2-compat-ioctl32-fix-missing-reserved-field-copy-in-put_v4l2_create32.p mm-use-phys_addr_t-for-reserve_bootmem_region-arguments.patch wait-ptrace-assume-__wall-if-the-child-is-traced.patch qe-uart-add-fsl-t1040-ucc-uart-to-of_device_id.patch -usbvision-fix-overflow-of-interfaces-array.patch pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes.patch powerpc-book3s64-fix-branching-to-ool-handlers-in-relocatable-kernel.patch powerpc-eeh-don-t-report-error-in-eeh_pe_reset_and_recover.patch diff --git a/queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch b/queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch deleted file mode 100644 index ec8a8a531d3..00000000000 --- a/queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 588afcc1c0e45358159090d95bf7b246fb67565f Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Tue, 27 Oct 2015 09:51:34 -0200 -Subject: [media] usbvision fix overflow of interfaces array - -From: Oliver Neukum - -commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream. - -This fixes the crash reported in: -http://seclists.org/bugtraq/2015/Oct/35 -The interface number needs a sanity check. - -Signed-off-by: Oliver Neukum -Cc: Vladis Dronov -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Cc: Moritz Muehlenhoff -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/media/usb/usbvision/usbvision-video.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1461,6 +1461,13 @@ static int usbvision_probe(struct usb_in - printk(KERN_INFO "%s: %s found\n", __func__, - usbvision_device_data[model].model_string); - -+ /* -+ * this is a security check. -+ * an exploit using an incorrect bInterfaceNumber is known -+ */ -+ if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) -+ return -ENODEV; -+ - if (usbvision_device_data[model].interface >= 0) - interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; - else if (ifnum < dev->actconfig->desc.bNumInterfaces) -- 2.47.3