Commit d979e9f9 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman

USB: serial: fix potential stack buffer overflow

Make sure to verify the maximum number of endpoints per type to avoid
writing beyond the end of a stack-allocated array.

The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of endpoints of a certain
type reported by a device did not exceed this limit.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 03936890
...@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_interface *interface, ...@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_interface *interface,
if (usb_endpoint_is_bulk_in(endpoint)) { if (usb_endpoint_is_bulk_in(endpoint)) {
/* we found a bulk in endpoint */ /* we found a bulk in endpoint */
dev_dbg(ddev, "found bulk in on endpoint %d\n", i); dev_dbg(ddev, "found bulk in on endpoint %d\n", i);
bulk_in_endpoint[num_bulk_in] = endpoint; if (num_bulk_in < MAX_NUM_PORTS) {
++num_bulk_in; bulk_in_endpoint[num_bulk_in] = endpoint;
++num_bulk_in;
}
} }
if (usb_endpoint_is_bulk_out(endpoint)) { if (usb_endpoint_is_bulk_out(endpoint)) {
/* we found a bulk out endpoint */ /* we found a bulk out endpoint */
dev_dbg(ddev, "found bulk out on endpoint %d\n", i); dev_dbg(ddev, "found bulk out on endpoint %d\n", i);
bulk_out_endpoint[num_bulk_out] = endpoint; if (num_bulk_out < MAX_NUM_PORTS) {
++num_bulk_out; bulk_out_endpoint[num_bulk_out] = endpoint;
++num_bulk_out;
}
} }
if (usb_endpoint_is_int_in(endpoint)) { if (usb_endpoint_is_int_in(endpoint)) {
/* we found a interrupt in endpoint */ /* we found a interrupt in endpoint */
dev_dbg(ddev, "found interrupt in on endpoint %d\n", i); dev_dbg(ddev, "found interrupt in on endpoint %d\n", i);
interrupt_in_endpoint[num_interrupt_in] = endpoint; if (num_interrupt_in < MAX_NUM_PORTS) {
++num_interrupt_in; interrupt_in_endpoint[num_interrupt_in] =
endpoint;
++num_interrupt_in;
}
} }
if (usb_endpoint_is_int_out(endpoint)) { if (usb_endpoint_is_int_out(endpoint)) {
/* we found an interrupt out endpoint */ /* we found an interrupt out endpoint */
dev_dbg(ddev, "found interrupt out on endpoint %d\n", i); dev_dbg(ddev, "found interrupt out on endpoint %d\n", i);
interrupt_out_endpoint[num_interrupt_out] = endpoint; if (num_interrupt_out < MAX_NUM_PORTS) {
++num_interrupt_out; interrupt_out_endpoint[num_interrupt_out] =
endpoint;
++num_interrupt_out;
}
} }
} }
...@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_interface *interface, ...@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_interface *interface,
if (usb_endpoint_is_int_in(endpoint)) { if (usb_endpoint_is_int_in(endpoint)) {
/* we found a interrupt in endpoint */ /* we found a interrupt in endpoint */
dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n"); dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n");
interrupt_in_endpoint[num_interrupt_in] = endpoint; if (num_interrupt_in < MAX_NUM_PORTS) {
++num_interrupt_in; interrupt_in_endpoint[num_interrupt_in] = endpoint;
++num_interrupt_in;
}
} }
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment