This is a note to let you know that I've just added the patch titled tty: n_gsm: fix buffer over-read in gsm_dlci_data() to the 5.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tty-n_gsm-fix-buffer-over-read-in-gsm_dlci_data.patch and it can be found in the queue-5.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From fd442e5ba30aaa75ea47b32149e7a3110dc20a46 Mon Sep 17 00:00:00 2001 From: Daniel Starke <daniel.starke@xxxxxxxxxxx> Date: Wed, 4 May 2022 10:17:31 +0200 Subject: tty: n_gsm: fix buffer over-read in gsm_dlci_data() From: Daniel Starke <daniel.starke@xxxxxxxxxxx> commit fd442e5ba30aaa75ea47b32149e7a3110dc20a46 upstream. 'len' is decreased after each octet that has its EA bit set to 0, which means that the value is encoded with additional octets. However, the final octet does not decreases 'len' which results in 'len' being one byte too long. A buffer over-read may occur in tty_insert_flip_string() as it tries to read one byte more than the passed content size of 'data'. Decrease 'len' also for the final octet which has the EA bit set to 1 to write the correct number of bytes from the internal receive buffer to the virtual tty. Fixes: 2e124b4a390c ("TTY: switch tty_flip_buffer_push") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Daniel Starke <daniel.starke@xxxxxxxxxxx> Link: https://lore.kernel.org/r/20220504081733.3494-1-daniel.starke@xxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/tty/n_gsm.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1658,6 +1658,7 @@ static void gsm_dlci_data(struct gsm_dlc if (len == 0) return; } + len--; slen++; tty = tty_port_tty_get(port); if (tty) { Patches currently in stable-queue which might be from daniel.starke@xxxxxxxxxxx are queue-5.17/tty-n_gsm-fix-buffer-over-read-in-gsm_dlci_data.patch queue-5.17/tty-n_gsm-fix-invalid-gsmtty_write_room-result.patch queue-5.17/tty-n_gsm-fix-mux-activation-issues-in-gsm_config.patch