This is a note to let you know that I've just added the patch titled
USB: serial: fix potential heap buffer overflow
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-fix-potential-heap-buffer-overflow.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5654699fb38512bdbfc0f892ce54fce75bdc2bab Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@xxxxxxxxxx>
Date: Wed, 27 Aug 2014 11:55:19 +0200
Subject: USB: serial: fix potential heap buffer overflow
From: Johan Hovold <johan@xxxxxxxxxx>
commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.
Make sure to verify the number of ports requested by subdriver to avoid
writing beyond the end of fixed-size array in interface data.
The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of ports requested by a
subdriver (which could have been determined from device descriptors) did
not exceed this limit.
Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/serial/usb-serial.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -876,6 +876,11 @@ static int usb_serial_probe(struct usb_i
num_ports = type->num_ports;
}
+ if (num_ports > MAX_NUM_PORTS) {
+ dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+ num_ports = MAX_NUM_PORTS;
+ }
+
serial->num_ports = num_ports;
serial->num_bulk_in = num_bulk_in;
serial->num_bulk_out = num_bulk_out;
Patches currently in stable-queue which might be from johan@xxxxxxxxxx are
queue-3.10/usb-serial-fix-potential-heap-buffer-overflow.patch
queue-3.10/revert-usb-option-zte_ev-move-most-zte-cdma-devices-to-zte_ev.patch
queue-3.10/usb-zte_ev-remove-duplicate-qualcom-pid.patch
queue-3.10/usb-serial-fix-potential-stack-buffer-overflow.patch
queue-3.10/usb-option-add-via-telecom-cds7-chipset-device-id.patch
queue-3.10/usb-option-reduce-interrupt-urb-logging-verbosity.patch
queue-3.10/usb-serial-pl2303-add-device-id-for-ztek-device.patch
queue-3.10/usb-zte_ev-remove-duplicate-gobi-pid.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html