]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 9fae77e) | patch
USB: serial: safe_serial: fix information leak in completion handler
authorJohan Hovold <johan@kernel.org>
Mon, 6 Mar 2017 16:36:41 +0000 (17:36 +0100)
committerJiri Slaby <jslaby@suse.cz>
Tue, 28 Mar 2017 13:49:14 +0000 (15:49 +0200)
commit4151dae02b2313c1981c34bd3f0da4febd463ca2
treecfa17b6e8986687d5cf1d5699e99d842a6e49a3ctree
parent9fae77e367815ef3b01a31095164e5c5b6903214commit | diff
USB: serial: safe_serial: fix information leak in completion handler

commit 8c76d7cd520ebffc1ea9ea0850d87a224a50c7f2 upstream.

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that could be triggered by a malicious device.

This avoids leaking up to 56 bytes from after the URB transfer buffer to
user space.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
drivers/usb/serial/safe_serial.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git