Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Greg Kroah-Hartman cc81fff9d6 USB: fix out-of-bounds in usb_set_configuration ... commit bd7a3fe770 upstream. Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes: It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount. And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller... Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2017-11-11 13:33:39 +00:00
..
asm-generic	asm-generic: Add renameat2 syscall	2014-05-20 10:59:38 +02:00
drm	xdrm/i915: Use two 32bit reads for select 64bit REG_READ ioctls	2015-08-11 09:57:37 +01:00
linux	USB: fix out-of-bounds in usb_set_configuration	2017-11-11 13:33:39 +00:00
mtd	mtd: lpddr: add driver for LPDDR2-NVM PCM memories	2014-05-20 17:45:17 -07:00
rdma	RDMA/uapi: Include socket.h in rdma_user_cm.h	2014-09-17 09:22:17 -07:00
scsi	FCoE Updates for 3.9	2013-03-01 09:10:08 +00:00
sound	ALSA: compress: fix the struct alignment to 4 bytes	2014-06-23 12:15:33 +02:00
video	UAPI: (Scripted) Disintegrate include/video	2012-12-20 17:14:26 +00:00
xen	xen: install xen/gntdev.h and xen/gntalloc.h	2014-02-11 10:12:36 -05:00
Kbuild	UAPI: (Scripted) Set up UAPI Kbuild files	2012-10-02 18:01:35 +01:00