aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohan Hovold <johan@kernel.org>2018-07-04 17:02:17 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-07-17 11:37:52 +0200
commit7675c7b78e34ece3829e85308f5e37f2fb62c11a (patch)
tree0650b53b10c3678d0abb4e11c65edecded6b2ee6
parent0fdef3142f99430b94f5d394ca2b181d20d87e77 (diff)
downloadlinux-linaro-stable-7675c7b78e34ece3829e85308f5e37f2fb62c11a.tar.gz
USB: serial: mos7840: fix status-register error handling
commit 794744abfffef8b1f3c0c8a4896177d6d13d653d upstream. Add missing transfer-length sanity check to the status-register completion handler to avoid leaking bits of uninitialised slab data to user space. Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver") Cc: stable <stable@vger.kernel.org> # 2.6.19 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/serial/mos7840.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 6baacf64b21e..03d63bad6be4 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -482,6 +482,9 @@ static void mos7840_control_callback(struct urb *urb)
}
dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
+ if (urb->actual_length < 1)
+ goto out;
+
dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__,
mos7840_port->MsrLsr, mos7840_port->port_num);
data = urb->transfer_buffer;