github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-03 03:53:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

Browse Source 
Add the missing sanity check on the size of interrupt-in transfers to
avoid parsing stale or uninitialised slab data (and leaking it to user
space).

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
Johan Hovold 2026-05-20 16:27:10 +02:00
parent 915b36d701
commit 245aba83e3
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/usb/serial/mct_u232.c
View File

@ -544,6 +544,11 @@ static void mct_u232_read_int_callback(struct urb *urb)
goto exit;
}
if (urb->actual_length < 2) {
dev_warn_ratelimited(&port->dev, "short interrupt-in packet\n");
goto exit;
}
/*
* The interrupt-in pipe signals exceptional conditions (modem line
* signal changes and errors). data[0] holds MSR, data[1] holds LSR.