lkml.org 
[lkml]   [2019]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 098/135] USB: CDC: fix sanity checks in CDC union parser
    Date
    From: Oliver Neukum <oneukum@suse.com>

    commit 54364278fb3cabdea51d6398b07c87415065b3fc upstream.

    A few checks checked for the size of the pointer to a structure
    instead of the structure itself. Copy & paste issue presumably.

    Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core")
    Cc: stable <stable@vger.kernel.org>
    Reported-by: syzbot+45a53506b65321c1fe91@syzkaller.appspotmail.com
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Link: https://lore.kernel.org/r/20190813093541.18889-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/core/message.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
    index e844bb7b5676a..5adf489428aad 100644
    --- a/drivers/usb/core/message.c
    +++ b/drivers/usb/core/message.c
    @@ -2218,14 +2218,14 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
    (struct usb_cdc_dmm_desc *)buffer;
    break;
    case USB_CDC_MDLM_TYPE:
    - if (elength < sizeof(struct usb_cdc_mdlm_desc *))
    + if (elength < sizeof(struct usb_cdc_mdlm_desc))
    goto next_desc;
    if (desc)
    return -EINVAL;
    desc = (struct usb_cdc_mdlm_desc *)buffer;
    break;
    case USB_CDC_MDLM_DETAIL_TYPE:
    - if (elength < sizeof(struct usb_cdc_mdlm_detail_desc *))
    + if (elength < sizeof(struct usb_cdc_mdlm_detail_desc))
    goto next_desc;
    if (detail)
    return -EINVAL;
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-08-22 19:26    [W:4.156 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site