Johan Hovold d0ef6ecee8 USB: serial: io_ti: fix information leak in completion handler ...

commit 654b404f2a upstream.

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that can be triggered by a malicious device.

This avoids leaking 128 kB of memory content from after the URB transfer
buffer to user space.

Fixes: 8c209e6782 ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-03-18 19:14:33 +08:00

..

aircable.c

…

ark3116.c

USB: serial: ark3116: fix register-accessor error handling

2017-02-26 11:10:52 +01:00

belkin_sa.c

…

belkin_sa.h

…

bus.c

…

ch341.c

USB: serial: ch341: fix modem-control and B0 handling

2017-01-19 20:18:04 +01:00

console.c

USB: serial: console: fix uninitialised spinlock

2017-02-26 11:10:52 +01:00

cp210x.c

USB: serial: cp210x: add new IDs for GE Bx50v3 boards

2017-02-26 11:10:51 +01:00

cyberjack.c

USB: serial: cyberjack: fix NULL-deref at open

2017-01-12 11:39:15 +01:00

cypress_m8.c

…

cypress_m8.h

…

digi_acceleport.c

USB: serial: digi_acceleport: fix OOB-event processing

2017-03-18 19:14:26 +08:00

empeg.c

…

ezusb_convert.pl

…

f81232.c

…

ftdi_sio_ids.h

USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad

2016-11-07 10:23:03 +01:00

ftdi_sio.c

USB: serial: ftdi_sio: fix line-status over-reporting

2017-02-26 11:10:51 +01:00

ftdi_sio.h

…

garmin_gps.c

USB: serial: garmin_gps: fix memory leak on failed URB submit

2017-01-12 11:39:14 +01:00

generic.c

USB: serial: use variable for status

2016-07-16 12:45:39 +02:00

io_16654.h

…

io_edgeport.c

USB: serial: io_edgeport: fix NULL-deref at open

2017-01-12 11:39:15 +01:00

io_edgeport.h

…

io_ionsp.h

…

io_tables.h

…

io_ti.c

USB: serial: io_ti: fix information leak in completion handler

2017-03-18 19:14:33 +08:00

io_ti.h

…

io_usbvend.h

…

ipaq.c

…

ipw.c

…

ir-usb.c

…

iuu_phoenix.c

USB: serial: iuu_phoenix: fix NULL-deref at open

2017-01-12 11:39:14 +01:00

iuu_phoenix.h

…

Kconfig

…

keyspan_pda.c

USB: serial: keyspan_pda: verify endpoints at probe

2017-01-12 11:39:13 +01:00

keyspan_usa26msg.h

…

keyspan_usa28msg.h

…

keyspan_usa49msg.h

…

keyspan_usa67msg.h

…

keyspan_usa90msg.h

…

keyspan.c

USB: serial: keyspan: fix debug and error messages

2016-05-10 09:39:57 +02:00

keyspan.h

…

kl5kusb105.c

USB: serial: kl5kusb105: fix line-state error handling

2017-01-19 20:18:01 +01:00

kl5kusb105.h

…

kobil_sct.c

USB: serial: kobil_sct: fix NULL-deref in write

2017-01-12 11:39:15 +01:00

kobil_sct.h

…

Makefile

…

Makefile-keyspan_pda_fw

…

mct_u232.c

…

mct_u232.h

…

metro-usb.c

…

mos7720.c

USB: serial: mos7720: fix parallel probe

2017-01-12 11:39:16 +01:00

mos7840.c

USB: serial: mos7840: fix another NULL-deref at open

2017-02-26 11:10:51 +01:00

mxuport.c

Merge tag 'usb-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2016-05-20 21:12:25 -07:00

navman.c

…

omninet.c

USB: serial: omninet: fix reference leaks at open

2017-03-18 19:14:32 +08:00

opticon.c

USB: serial: opticon: fix CTS retrieval at open

2017-02-26 11:10:52 +01:00

option.c

USB: serial: option: add device ID for HP lt2523 (Novatel E371)

2017-02-09 08:08:30 +01:00

oti6858.c

USB: serial: oti6858: fix NULL-deref at open

2017-01-12 11:39:15 +01:00

oti6858.h

…

pl2303.c

USB: serial: pl2303: add ATEN device ID

2017-02-09 08:08:29 +01:00

pl2303.h

USB: serial: pl2303: add ATEN device ID

2017-02-09 08:08:29 +01:00

qcaux.c

…

qcserial.c

USB: serial: qcserial: add Dell DW5570 QDL

2017-02-09 08:08:29 +01:00

quatech2.c

USB: serial: quatech2: fix sleep-while-atomic in close

2017-01-12 11:39:13 +01:00

safe_serial.c

USB: serial: safe_serial: fix information leak in completion handler

2017-03-18 19:14:32 +08:00

sierra.c

…

spcp8x5.c

USB: serial: spcp8x5: fix modem-status handling

2017-02-26 11:10:51 +01:00

ssu100.c

…

symbolserial.c

…

ti_usb_3410_5052.c

USB: serial: ti_usb_3410_5052: fix NULL-deref at open

2017-01-12 11:39:15 +01:00

usb_debug.c

…

usb_wwan.c

…

usb-serial-simple.c

USB: serial: simple: add support for another Infineon flashloader

2016-09-12 10:19:41 +02:00

usb-serial.c

USB: serial: fix potential NULL-dereference at probe

2016-10-21 16:47:17 +02:00

usb-wwan.h

…

visor.c

…

visor.h

…

whiteheat.c

…

whiteheat.h

…

wishbone-serial.c

…

xsens_mt.c

…