Johan Hovold 8c76d7cd52 USB: serial: safe_serial: fix information leak in completion handler ...

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that could be triggered by a malicious device.

This avoids leaking up to 56 bytes from after the URB transfer buffer to
user space.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>

2017-03-08 16:14:42 +01:00

..

aircable.c

…

ark3116.c

USB: serial: ark3116: use port device for info and error messages

2017-01-31 17:21:38 +01:00

belkin_sa.c

…

belkin_sa.h

…

bus.c

…

ch341.c

USB: serial: ch341: change initial line-control settings

2017-01-16 12:32:21 +01:00

console.c

USB: serial: console: clean up sanity checks

2017-02-08 21:20:49 +01:00

cp210x.c

Merge tag 'usb-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2017-02-22 11:15:59 -08:00

cyberjack.c

…

cypress_m8.c

USB: serial: cypress_m8: remove unused variable

2017-01-16 12:26:58 +01:00

cypress_m8.h

…

digi_acceleport.c

USB: serial: digi_acceleport: fix OOB-event processing

2017-03-06 09:18:40 +01:00

empeg.c

…

ezusb_convert.pl

…

f81232.c

…

f81534.c

…

ftdi_sio_ids.h

…

ftdi_sio.c

USB: serial: ftdi_sio: fix line-status over-reporting

2017-02-06 18:29:06 +01:00

ftdi_sio.h

…

garmin_gps.c

USB: serial: garmin_gps: fix memory leak on failed URB submit

2017-01-04 10:37:15 +01:00

generic.c

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

io_16654.h

…

io_edgeport.c

USB: serial: io_edgeport: drop io-tables header file

2017-02-15 17:42:05 +01:00

io_edgeport.h

…

io_ionsp.h

…

io_ti.c

USB: serial: io_ti: fix information leak in completion handler

2017-03-08 16:14:39 +01:00

io_ti.h

…

io_usbvend.h

…

ipaq.c

…

ipw.c

…

ir-usb.c

…

iuu_phoenix.c

USB: serial: iuu_phoenix: remove unused buffer from open

2017-01-16 16:38:56 +01:00

iuu_phoenix.h

…

Kconfig

USB: serial: add uPD78F0730 USB to Serial Adaptor Driver

2017-01-26 10:18:17 +01:00

keyspan_pda.c

USB: serial: keyspan_pda: fix receive sanity checks

2017-01-31 18:33:00 +01:00

keyspan_usa26msg.h

…

keyspan_usa28msg.h

…

keyspan_usa49msg.h

…

keyspan_usa67msg.h

…

keyspan_usa90msg.h

…

keyspan.c

USB: serial: keyspan: drop header file

2017-02-15 17:42:28 +01:00

kl5kusb105.c

USB: serial: kl5kusb105: remove unused termios structure

2017-01-16 13:00:22 +01:00

kl5kusb105.h

…

kobil_sct.c

USB: serial: kobil_sct: fix NULL-deref in write

2017-01-04 10:37:18 +01:00

kobil_sct.h

…

Makefile

USB: serial: add uPD78F0730 USB to Serial Adaptor Driver

2017-01-26 10:18:17 +01:00

Makefile-keyspan_pda_fw

…

mct_u232.c

USB: serial: mct_u232: fix modem-status error handling

2017-01-16 16:38:56 +01:00

mct_u232.h

…

metro-usb.c

USB: serial: metro-usb: drop redundant URB reinitialisation

2017-02-08 19:28:02 +01:00

mos7720.c

USB: serial: drop unused ASYNC flags

2017-01-26 09:49:13 +01:00

mos7840.c

USB: serial: mos7840: fix another NULL-deref at open

2017-02-09 13:15:07 +01:00

mxuport.c

…

navman.c

…

omninet.c

USB: serial: omninet: drop open callback

2017-03-08 16:14:37 +01:00

opticon.c

USB: serial: drop unused ASYNC flags

2017-01-26 09:49:13 +01:00

option.c

USB: serial: option: add device ID for HP lt2523 (Novatel E371)

2017-01-24 12:07:28 +01:00

oti6858.c

USB: serial: oti6858: fix NULL-deref at open

2017-01-04 10:43:48 +01:00

oti6858.h

…

pl2303.c

Merge tag 'usb-serial-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next

2017-02-09 13:57:05 +01:00

pl2303.h

USB: serial: pl2303: add ATEN device ID

2017-01-31 17:27:04 +01:00

qcaux.c

…

qcserial.c

USB: serial: qcserial: add Dell DW5570 QDL

2017-01-19 09:08:37 +01:00

quatech2.c

USB: serial: drop unused ASYNC flags

2017-01-26 09:49:13 +01:00

safe_serial.c

USB: serial: safe_serial: fix information leak in completion handler

2017-03-08 16:14:42 +01:00

sierra.c

USB: serial: sierra: fix bogus alternate-setting assumption

2017-02-06 18:29:17 +01:00

spcp8x5.c

USB: serial: spcp8x5: fix modem-status handling

2017-01-16 16:38:56 +01:00

ssu100.c

USB: serial: drop unused ASYNC flags

2017-01-26 09:49:13 +01:00

symbolserial.c

…

ti_usb_3410_5052.c

USB: serial: ti_usb_3410_5052: fix control-message error handling

2017-01-16 16:38:57 +01:00

upd78f0730.c

USB: serial: upd78f0730: sort device ids

2017-02-13 14:50:44 +01:00

usb_debug.c

…

usb_wwan.c

…

usb-serial-simple.c

…

usb-serial.c

…

usb-wwan.h

…

visor.c

…

visor.h

…

whiteheat.c

USB: serial: drop unused ASYNC flags

2017-01-26 09:49:13 +01:00

whiteheat.h

…

wishbone-serial.c

…

xsens_mt.c

…