kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/serial
History
Qasim Ijaz 6377838560 USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() 
commit 575a5adf48 upstream.

This patch addresses a null-ptr-deref in qt2_process_read_urb() due to
an incorrect bounds check in the following:

       if (newport > serial->num_ports) {
               dev_err(&port->dev,
                       "%s - port change to invalid port: %i\n",
                       __func__, newport);
               break;
       }

The condition doesn't account for the valid range of the serial->port
buffer, which is from 0 to serial->num_ports - 1. When newport is equal
to serial->num_ports, the assignment of "port" in the
following code is out-of-bounds and NULL:

       serial_priv->current_port = newport;
       port = serial->port[serial_priv->current_port];

The fix checks if newport is greater than or equal to serial->num_ports
indicating it is out-of-bounds.

Reported-by: syzbot <syzbot+506479ebf12fe435d01a@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=506479ebf12fe435d01a
Fixes: f7a33e608d ("USB: serial: add quatech2 usb to serial driver")
Cc: <stable@vger.kernel.org>      # 3.5
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-02-01 18:37:55 +01:00
..
aircable.c USB: serial: drop redundant transfer-buffer casts 2020-07-09 09:20:17 +02:00
ark3116.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
belkin_sa.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
belkin_sa.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
bus.c USB: mark all struct bus_type as const 2023-03-23 13:22:00 +01:00
ch341.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
console.c tty: Cleanup tty_port_set_initialized() bool parameter 2023-01-19 16:04:34 +01:00
cp210x.c USB: serial: cp210x: add Phoenix Contact UPS Device 2025-01-17 13:36:20 +01:00
cyberjack.c USB: serial: make usb_serial_driver::write_room return uint 2021-05-19 10:56:40 +02:00
cypress_m8.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
cypress_m8.h USB: serial: cypress_m8: enable Simply Automated UPB PIM 2020-06-23 09:56:17 +02:00
digi_acceleport.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
empeg.c docs: usb: rename files to .rst and add them to drivers-api 2019-06-20 14:28:36 +02:00
ezusb_convert.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
f81232.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
f81534.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
ftdi_sio.c USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB 2024-04-03 15:28:24 +02:00
ftdi_sio.h USB: serial: ftdi_sio: rename channel index 2022-09-15 08:05:53 +02:00
ftdi_sio_ids.h USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB 2024-04-03 15:28:24 +02:00
garmin_gps.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
generic.c USB: serial: make usb_serial_driver::chars_in_buffer return uint 2021-05-19 10:56:41 +02:00
io_16654.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
io_edgeport.c USB: serial: io_edgeport: fix use after free in debug printk 2024-11-14 13:19:40 +01:00
io_edgeport.h USB: serial: io_edgeport: drop unused definitions 2021-04-08 09:50:04 +02:00
io_ionsp.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
io_ti.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
io_ti.h USB: serial: io_ti: drop unnecessary packed attributes 2021-04-13 18:23:34 +02:00
io_usbvend.h USB: serial: io_ti: add Agilent E5805A support 2022-06-09 14:13:28 +02:00
ipaq.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
ipw.c USB: serial: Remove redundant license text 2017-11-04 11:55:38 +01:00
ir-usb.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
iuu_phoenix.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
iuu_phoenix.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
Kconfig USB: serial: simple: add Nokia phone driver 2022-03-03 09:27:36 +01:00
keyspan.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
keyspan_pda.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
keyspan_usa26msg.h USB: serial: keyspan_usa: add proper SPDX lines for .h files 2019-01-18 11:09:32 +01:00
keyspan_usa28msg.h USB: serial: keyspan_usa: add proper SPDX lines for .h files 2019-01-18 11:09:32 +01:00
keyspan_usa49msg.h USB: serial: keyspan_usa: add proper SPDX lines for .h files 2019-01-18 11:09:32 +01:00
keyspan_usa67msg.h USB: serial: keyspan_usa: add proper SPDX lines for .h files 2019-01-18 11:09:32 +01:00
keyspan_usa90msg.h USB: serial: keyspan_usa: add proper SPDX lines for .h files 2019-01-18 11:09:32 +01:00
kl5kusb105.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
kl5kusb105.h USB: serial: kl5kusb105: remove KLSI device id 2018-07-11 10:11:29 +02:00
kobil_sct.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
kobil_sct.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile USB: serial: add MaxLinear/Exar USB to Serial driver 2021-01-21 10:49:37 +01:00
Makefile-keyspan_pda_fw USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
mct_u232.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
mct_u232.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
metro-usb.c USB: serial: drop irq-flags initialisations 2021-05-21 15:46:25 +02:00
mos7720.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
mos7840.c USB: serial: mos7840: fix crash on resume 2024-07-18 13:21:18 +02:00
mxuport.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
navman.c USB: serial: fix module-license macros 2017-11-04 11:58:00 +01:00
omninet.c USB: serial: omninet: update driver description 2021-05-25 08:59:17 +02:00
opticon.c USB: serial: use kmemdup instead of kmalloc + memcpy 2022-06-22 08:56:52 +02:00
option.c USB: serial: option: add Neoway N723-EA support 2025-01-17 13:36:20 +01:00
oti6858.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
oti6858.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
pl2303.c USB: serial: pl2303: add device id for Macrosilicon MS3020 2024-09-30 16:25:14 +02:00
pl2303.h USB: serial: pl2303: add device id for Macrosilicon MS3020 2024-09-30 16:25:14 +02:00
qcaux.c USB: serial: fix module-license macros 2017-11-04 11:58:00 +01:00
qcserial.c USB: serial: qcserial: add support for Sierra Wireless EM86xx 2024-11-14 13:19:40 +01:00
quatech2.c USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() 2025-02-01 18:37:55 +01:00
safe_serial.c USB: serial: Remove redundant license text 2017-11-04 11:55:38 +01:00
sierra.c USB: serial: fix tty-port initialized comments 2022-07-25 11:01:40 +02:00
spcp8x5.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
ssu100.c usb: serial: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
symbolserial.c USB: serial: make remove callback return void 2021-02-09 13:13:58 +01:00
ti_usb_3410_5052.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
upd78f0730.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
usb-serial-simple.c USB: serial: simple: sort driver entries 2023-07-20 15:59:25 +02:00
usb-serial.c tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
usb-wwan.h USB: serial: make usb_serial_driver::chars_in_buffer return uint 2021-05-19 10:56:41 +02:00
usb_debug.c USB: serial: debug: do not echo input by default 2024-08-14 13:58:54 +02:00
usb_wwan.c USB-serial updates for 5.20-rc1 2022-07-25 11:28:52 +02:00
visor.c docs: usb: rename files to .rst and add them to drivers-api 2019-06-20 14:28:36 +02:00
visor.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
whiteheat.c USB: serial: return errors from break handling 2023-06-07 17:00:23 +02:00
whiteheat.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
wishbone-serial.c USB: serial: Remove redundant license text 2017-11-04 11:55:38 +01:00
xr_serial.c USB: serial: xr: add TIOCGRS485 and TIOCSRS485 ioctls 2023-07-20 15:37:03 +02:00
xsens_mt.c USB: serial: fix module-license macros 2017-11-04 11:58:00 +01:00