]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2b6aa62) | patch
USB: serial: safe_serial: fix information leak in completion handler
authorJohan Hovold <johan@kernel.org>
Mon, 6 Mar 2017 16:36:41 +0000 (17:36 +0100)
committerWilly Tarreau <w@1wt.eu>
Wed, 7 Jun 2017 22:47:03 +0000 (00:47 +0200)
commit61ab4e5c98a47b11ba1bf50bbab5673c40868fde
tree23385b4ee66f72951c30f6c1c6efc4598335d2e0tree
parent2b6aa6271ad4dd92c397829171ba6c64223f4b55commit | diff
USB: serial: safe_serial: fix information leak in completion handler

commit 8c76d7cd520ebffc1ea9ea0850d87a224a50c7f2 upstream.

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that could be triggered by a malicious device.

This avoids leaking up to 56 bytes from after the URB transfer buffer to
user space.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/usb/serial/safe_serial.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git