github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-02 19:43:40 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

USB: serial: digi_acceleport: fix memory corruption with small endpoints

Browse Source 
Add the missing bulk-out buffer size sanity checks to avoid
out-of-bounds memory accesses or slab corruption should a malicious
device report smaller buffers than expected.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
Johan Hovold 2026-05-20 16:26:22 +02:00
parent 4ce058df2e
commit cb3560e8ea
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/usb/serial/digi_acceleport.c
View File

@ -1229,15 +1229,34 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
static int digi_startup(struct usb_serial *serial)
{
struct digi_serial *serial_priv;
int oob_port_num;
int ret;
int i;
/*
* The port bulk-out buffers must be large enough for header and
* buffered data.
*/
for (i = 0; i < serial->type->num_ports; i++) {
if (serial->port[i]->bulk_out_size < DIGI_OUT_BUF_SIZE + 2)
return -EINVAL;
}
/*
* The OOB port bulk-out buffer must be large enough for the two
* commands in digi_set_modem_signals().
*/
oob_port_num = serial->type->num_ports;
if (serial->port[oob_port_num]->bulk_out_size < 8)
return -EINVAL;
serial_priv = kzalloc_obj(*serial_priv);
if (!serial_priv)
return -ENOMEM;
spin_lock_init(&serial_priv->ds_serial_lock);
serial_priv->ds_oob_port_num = serial->type->num_ports;
serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
serial_priv->ds_oob_port_num = oob_port_num;
serial_priv->ds_oob_port = serial->port[oob_port_num];
ret = digi_port_init(serial_priv->ds_oob_port,
serial_priv->ds_oob_port_num);