usb: cdc-acm: Fix handling of oversized fragments

commit 12e712964f41d05ae034989892de445781c46730 upstream.

If we receive an initial fragment of size 8 bytes which specifies a wLength
of 1 byte (so the reassembled message is supposed to be 9 bytes long), and
we then receive a second fragment of size 9 bytes (which is not supposed to
happen), we currently wrongly bypass the fragment reassembly code but still
pass the pointer to the acm->notification_buffer to
acm_process_notification().

Make this less wrong by always going through fragment reassembly when we
expect more fragments.

Before this patch, receiving an overlong fragment could lead to `newctrl`
in acm_process_notification() being uninitialized data (instead of data
coming from the device).

Cc: stable <stable@kernel.org>
Fixes: ea2583529cd1 ("cdc-acm: reassemble fragmented notifications")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 86d00f17527f2fdac6b29dbca731ad8dc6b2c451..571b70b9231cf8ad0a9e7c754475090371c339fe 100644 (file)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -405,7 +405,7 @@ static void acm_ctrl_irq(struct urb *urb)
        expected_size = sizeof(struct usb_cdc_notification) +
                                        le16_to_cpu(dr->wLength);
 
-       if (current_size < expected_size) {
+       if (acm->nb_index != 0 || current_size < expected_size) {
                /* notification is transmitted fragmented, reassemble */
                if (acm->nb_size < expected_size) {
                        u8 *new_buffer;