Commit 1251dab9 authored Oct 29, 2019 by Johan Hovold Committed by Greg Kroah-Hartman Oct 30, 2019

USB: serial: whiteheat: fix potential slab corruption



Fix a user-controlled slab buffer overflow due to a missing sanity check
on the bulk-out transfer buffer used for control requests.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191029102354.2733-2-johan@kernel.org


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 54f83b8c

drivers/usb/serial/whiteheat.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -559,6 +559,10 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command,

		command_port = port->serial->port[COMMAND_PORT];
		command_info = usb_get_serial_port_data(command_port);

		if (command_port->bulk_out_size < datasize + 1)
		return -EIO;

		mutex_lock(&command_info->mutex);
		command_info->command_finished = false;

Admin message