USB serial fixes for 7.1-rc8

Here is one more buffer overflow fix.
 
 This one has been in linux-next overnight with no reported issues.
 -----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQQHbPq+cpGvN/peuzMLxc3C7H1lCAUCaikW3hsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQC8XNwux9ZQidKgEAlHiGdPFKm8MuvqvqYc6s
 g4Zey9+ESSjQSQVUmQEmCU8A/1K8h6RTHYBiO47AjPD8zXDhW5dmwA8BcHGNaTlK
 WA0M
 =OepR
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-7.1-rc8' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB serial fixes for 7.1-rc8

Here is one more buffer overflow fix.

This one has been in linux-next overnight with no reported issues.

* tag 'usb-serial-7.1-rc8' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: kl5kusb105: fix bulk-out buffer overflow
This commit is contained in:
Greg Kroah-Hartman 2026-06-10 12:25:33 +02:00
commit e47832c73b

View File

@ -330,8 +330,8 @@ static int klsi_105_prepare_write_buffer(struct usb_serial_port *port,
unsigned char *buf = dest;
int count;
count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size,
&port->lock);
count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,
size - KLSI_HDR_LEN, &port->lock);
put_unaligned_le16(count, buf);
return count + KLSI_HDR_LEN;