lkml.org 
[lkml]   [2017]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.10 38/48] USB: serial: io_ti: fix NULL-deref in interrupt callback
    Date
    4.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit 0b1d250afb8eb9d65afb568bac9b9f9253a82b49 upstream.

    Fix a NULL-pointer dereference in the interrupt callback should a
    malicious device send data containing a bad port number by adding the
    missing sanity check.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/io_ti.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/drivers/usb/serial/io_ti.c
    +++ b/drivers/usb/serial/io_ti.c
    @@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(stru
    function = TIUMP_GET_FUNC_FROM_CODE(data[0]);
    dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
    port_number, function, data[1]);
    +
    + if (port_number >= edge_serial->serial->num_ports) {
    + dev_err(dev, "bad port number %d\n", port_number);
    + goto exit;
    + }
    +
    port = edge_serial->serial->port[port_number];
    edge_port = usb_get_serial_port_data(port);
    if (!edge_port) {

    \
     
     \ /
      Last update: 2017-03-16 15:36    [W:4.164 / U:0.624 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site