Searched hist:"691 a03cfe8ca483f9c48153b869d354e4ae3abef" (Results 1 – 1 of 1) sorted by relevance
| /linux/drivers/usb/serial/ |
| H A D | io_ti.h | diff 691a03cfe8ca483f9c48153b869d354e4ae3abef Tue Aug 21 11:59:52 CEST 2018 Johan Hovold <johan@kernel.org> USB: serial: io_ti: fix array underflow in completion handler
As reported by Dan Carpenter, a malicious USB device could set
port_number to a negative value and we would underflow the port array in
the interrupt completion handler.
As these devices only have one or two ports, fix this by making sure we
only consider the seventh bit when determining the port number (and
ignore bits 0xb0 which are typically set to 0x30).
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
|