]> git.ipfire.org Git - thirdparty/linux.git/commit
projects / thirdparty / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 60df93d) | patch
USB: serial: safe_serial: fix memory corruption with small endpoint
authorJohan Hovold <johan@kernel.org>
Fri, 22 May 2026 14:22:18 +0000 (16:22 +0200)
committerJohan Hovold <johan@kernel.org>
Sat, 23 May 2026 07:07:36 +0000 (09:07 +0200)
commit438061ed1ad85e6743e2dce826671772d81089ec
treedaaee33b20e214c31d701e365aa92820543ed011tree | snapshot
parent60df93d30f9bdd27db17c4d80ed80ef718d7226bcommit | diff
USB: serial: safe_serial: fix memory corruption with small endpoint

Make sure that the bulk-out buffer size is at least eight bytes to avoid
user-controlled slab corruption in "safe" mode should a malicious device
report a smaller size.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
drivers/usb/serial/safe_serial.c diff | blob | blame | history
A mirror of Linus' kernel repository