USB: serial: mct_u232: fix memory corruption with small endpoint

Browse source

commit 915b36d701 upstream.

The driver overrides the maximum transfer size for a specific device
which only accepts 16 byte packets for its 32 byte bulk-out endpoint.

Make sure to never increase the maximum transfer size to prevent slab
corruption should a malicious device report a smaller endpoint max
packet size than expected.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Johan Hovold 2026-06-04 14:11:33 +02:00 • committed by Greg Kroah-Hartman

parent fec41484e7

commit bd2ddb3fe9

1 changed files with 11 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

21

drivers/usb/serial/mct_u232.c

View file