Patch "USB: serial: fix potential heap buffer overflow" has been added to the 3.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    USB: serial: fix potential heap buffer overflow

to the 3.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-serial-fix-potential-heap-buffer-overflow.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 5654699fb38512bdbfc0f892ce54fce75bdc2bab Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@xxxxxxxxxx>
Date: Wed, 27 Aug 2014 11:55:19 +0200
Subject: USB: serial: fix potential heap buffer overflow

From: Johan Hovold <johan@xxxxxxxxxx>

commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.

Make sure to verify the number of ports requested by subdriver to avoid
writing beyond the end of fixed-size array in interface data.

The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of ports requested by a
subdriver (which could have been determined from device descriptors) did
not exceed this limit.

Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

---
 drivers/usb/serial/usb-serial.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -876,6 +876,11 @@ static int usb_serial_probe(struct usb_i
 			num_ports = type->num_ports;
 	}
 
+	if (num_ports > MAX_NUM_PORTS) {
+		dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+		num_ports = MAX_NUM_PORTS;
+	}
+
 	serial->num_ports = num_ports;
 	serial->num_bulk_in = num_bulk_in;
 	serial->num_bulk_out = num_bulk_out;


Patches currently in stable-queue which might be from johan@xxxxxxxxxx are

queue-3.10/usb-serial-fix-potential-heap-buffer-overflow.patch
queue-3.10/revert-usb-option-zte_ev-move-most-zte-cdma-devices-to-zte_ev.patch
queue-3.10/usb-zte_ev-remove-duplicate-qualcom-pid.patch
queue-3.10/usb-serial-fix-potential-stack-buffer-overflow.patch
queue-3.10/usb-option-add-via-telecom-cds7-chipset-device-id.patch
queue-3.10/usb-option-reduce-interrupt-urb-logging-verbosity.patch
queue-3.10/usb-serial-pl2303-add-device-id-for-ztek-device.patch
queue-3.10/usb-zte_ev-remove-duplicate-gobi-pid.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]