lkml.org 
[lkml]   [2018]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 28/67] USB: serial: mos7840: fix status-register error handling
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit 794744abfffef8b1f3c0c8a4896177d6d13d653d upstream.

    Add missing transfer-length sanity check to the status-register
    completion handler to avoid leaking bits of uninitialised slab data to
    user space.

    Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
    Cc: stable <stable@vger.kernel.org> # 2.6.19
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/mos7840.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/usb/serial/mos7840.c
    +++ b/drivers/usb/serial/mos7840.c
    @@ -468,6 +468,9 @@ static void mos7840_control_callback(str
    }

    dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
    + if (urb->actual_length < 1)
    + goto out;
    +
    dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__,
    mos7840_port->MsrLsr, mos7840_port->port_num);
    data = urb->transfer_buffer;

    \
     
     \ /
      Last update: 2018-07-16 09:58    [W:7.169 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site