lkml.org 
[lkml]   [2019]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 120/149] USB: serial: whiteheat: fix potential slab corruption
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 1251dab9e0a2c4d0d2d48370ba5baa095a5e8774 upstream.

    Fix a user-controlled slab buffer overflow due to a missing sanity check
    on the bulk-out transfer buffer used for control requests.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20191029102354.2733-2-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/whiteheat.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/drivers/usb/serial/whiteheat.c
    +++ b/drivers/usb/serial/whiteheat.c
    @@ -571,6 +571,10 @@ static int firm_send_command(struct usb_

    command_port = port->serial->port[COMMAND_PORT];
    command_info = usb_get_serial_port_data(command_port);
    +
    + if (command_port->bulk_out_size < datasize + 1)
    + return -EIO;
    +
    mutex_lock(&command_info->mutex);
    command_info->command_finished = false;


    \
     
     \ /
      Last update: 2019-11-04 23:18    [W:4.893 / U:0.408 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site