USB: serial: iuu_phoenix: fix memory corruption (e7b931be) · Commits · 戴 / test

The driver would happily overwrite its write buffer with user data in 256 byte increments due to a removed buffer-space sanity check. Fixes: ("tty: iuu_phoenix: fix locking.") Cc: stable <stable@vger.kernel.org> # 2.6.31 Signed-off-by:

Johan Hovold <johan@kernel.org>

drivers/usb/serial/iuu_phoenix.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -697,14 +697,16 @@ static int iuu_uart_write(struct tty_struct tty, struct usb_serial_port port,
		struct iuu_private *priv = usb_get_serial_port_data(port);
		unsigned long flags;

		if (count > 256)
		return -ENOMEM;

		spin_lock_irqsave(&priv->lock, flags);

		count = min(count, 256 - priv->writelen);
		if (count == 0)
		goto out;

		/* fill the buffer */
		memcpy(priv->writebuf + priv->writelen, buf, count);
		priv->writelen += count;
		out:
		spin_unlock_irqrestore(&priv->lock, flags);

		return count;

Admin message