Johan Hovold 72bb2b96b8 USB: serial: io_ti: fix information leak in completion handler ...

commit 654b404f2a upstream.

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that can be triggered by a malicious device.

This avoids leaking 128 kB of memory content from after the URB transfer
buffer to user space.

Fixes: 8c209e6782 ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-03-18 19:09:58 +08:00

..

aircable.c

…

ark3116.c

USB: serial: ark3116: fix register-accessor error handling

2017-02-26 11:07:51 +01:00

belkin_sa.c

…

belkin_sa.h

…

bus.c

…

ch341.c

USB: serial: ch341: fix modem-control and B0 handling

2017-01-19 20:17:21 +01:00

console.c

…

cp210x.c

USB: serial: cp210x: add new IDs for GE Bx50v3 boards

2017-02-26 11:07:50 +01:00

cyberjack.c

USB: serial: cyberjack: fix NULL-deref at open

2017-01-12 11:22:46 +01:00

cypress_m8.c

…

cypress_m8.h

…

digi_acceleport.c

USB: serial: digi_acceleport: fix OOB-event processing

2017-03-18 19:09:56 +08:00

empeg.c

…

ezusb_convert.pl

…

f81232.c

…

ftdi_sio_ids.h

USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad

2016-12-02 09:09:00 +01:00

ftdi_sio.c

USB: serial: ftdi_sio: fix line-status over-reporting

2017-02-26 11:07:51 +01:00

ftdi_sio.h

…

garmin_gps.c

USB: serial: garmin_gps: fix memory leak on failed URB submit

2017-01-12 11:22:46 +01:00

generic.c

…

io_16654.h

…

io_edgeport.c

USB: serial: io_edgeport: fix NULL-deref at open

2017-01-12 11:22:46 +01:00

io_edgeport.h

…

io_ionsp.h

…

io_tables.h

…

io_ti.c

USB: serial: io_ti: fix information leak in completion handler

2017-03-18 19:09:58 +08:00

io_ti.h

…

io_usbvend.h

…

ipaq.c

…

ipw.c

…

ir-usb.c

…

iuu_phoenix.c

USB: serial: iuu_phoenix: fix NULL-deref at open

2017-01-12 11:22:46 +01:00

iuu_phoenix.h

…

Kconfig

…

keyspan_pda.c

USB: serial: keyspan_pda: verify endpoints at probe

2017-01-12 11:22:45 +01:00

keyspan_usa26msg.h

…

keyspan_usa28msg.h

…

keyspan_usa49msg.h

…

keyspan_usa67msg.h

…

keyspan_usa90msg.h

…

keyspan.c

…

keyspan.h

…

kl5kusb105.c

USB: serial: kl5kusb105: fix line-state error handling

2017-01-19 20:17:20 +01:00

kl5kusb105.h

…

kobil_sct.c

USB: serial: kobil_sct: fix NULL-deref in write

2017-01-12 11:22:46 +01:00

kobil_sct.h

…

Makefile

…

Makefile-keyspan_pda_fw

…

mct_u232.c

…

mct_u232.h

…

metro-usb.c

…

mos7720.c

USB: serial: mos7720: fix parallel probe

2017-01-12 11:22:46 +01:00

mos7840.c

USB: serial: mos7840: fix another NULL-deref at open

2017-02-26 11:07:50 +01:00

mxuport.c

…

navman.c

…

omninet.c

USB: serial: omninet: fix reference leaks at open

2017-03-18 19:09:58 +08:00

opticon.c

USB: serial: opticon: fix CTS retrieval at open

2017-02-26 11:07:51 +01:00

option.c

USB: serial: option: add device ID for HP lt2523 (Novatel E371)

2017-02-09 08:02:46 +01:00

oti6858.c

USB: serial: oti6858: fix NULL-deref at open

2017-01-12 11:22:46 +01:00

oti6858.h

…

pl2303.c

USB: serial: pl2303: add ATEN device ID

2017-02-09 08:02:46 +01:00

pl2303.h

USB: serial: pl2303: add ATEN device ID

2017-02-09 08:02:46 +01:00

qcaux.c

…

qcserial.c

USB: serial: qcserial: add Dell DW5570 QDL

2017-02-09 08:02:46 +01:00

quatech2.c

USB: serial: quatech2: fix sleep-while-atomic in close

2017-01-12 11:22:45 +01:00

safe_serial.c

USB: serial: safe_serial: fix information leak in completion handler

2017-03-18 19:09:57 +08:00

sierra.c

…

spcp8x5.c

USB: serial: spcp8x5: fix modem-status handling

2017-02-26 11:07:51 +01:00

ssu100.c

…

symbolserial.c

…

ti_usb_3410_5052.c

USB: serial: ti_usb_3410_5052: fix NULL-deref at open

2017-01-12 11:22:46 +01:00

ti_usb_3410_5052.h

…

usb_debug.c

…

usb_wwan.c

…

usb-serial-simple.c

…

usb-serial.c

USB: serial: fix potential NULL-dereference at probe

2016-11-10 16:36:33 +01:00

usb-wwan.h

…

visor.c

…

visor.h

…

whiteheat.c

…

whiteheat.h

…

wishbone-serial.c

…

xsens_mt.c

…