kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/w1
History
Alan Stern ef6b71388a USB: w1 ds2490: Fix bug caused by improper use of altsetting array 
commit c114944d7d upstream.

The syzkaller USB fuzzer spotted a slab-out-of-bounds bug in the
ds2490 driver.  This bug is caused by improper use of the altsetting
array in the usb_interface structure (the array's entries are not
always stored in numerical order), combined with a naive assumption
that all interfaces probed by the driver will have the expected number
of altsettings.

The bug can be fixed by replacing references to the possibly
non-existent intf->altsetting[alt] entry with the guaranteed-to-exist
intf->cur_altsetting entry.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+d65f673b847a1a96cdba@syzkaller.appspotmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-08-13 12:39:15 +01:00
..
masters USB: w1 ds2490: Fix bug caused by improper use of altsetting array 2019-08-13 12:39:15 +01:00
slaves w1: support auto-load of w1_bq27000 module. 2018-11-20 18:04:54 +00:00
Kconfig Kconfig: replace "--- help ---" with "---help---" 2012-05-07 15:01:22 +02:00
Makefile [PATCH] better CONFIG_W1_SLAVE_DS2433_CRC handling 2006-12-07 08:39:43 -08:00
w1.c 1wire: family module autoload fails because of upper/lower case mismatch. 2018-11-20 18:04:54 +00:00
w1.h w1: optional bundling of netlink kernel replies 2014-05-27 13:56:21 -07:00
w1_family.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
w1_family.h w1: support auto-load of w1_bq27000 module. 2018-11-20 18:04:54 +00:00
w1_int.c w1: do not unlock unheld list_mutex in __w1_remove_master_device() 2014-05-27 14:08:46 -07:00
w1_int.h MAINTAINERS: Evgeniy has moved 2011-08-25 16:25:33 -07:00
w1_io.c w1: format for DocBook and fixes 2014-02-07 15:40:18 -08:00
w1_log.h MAINTAINERS: Evgeniy has moved 2011-08-25 16:25:33 -07:00
w1_netlink.c w1: optional bundling of netlink kernel replies 2014-05-27 13:56:21 -07:00
w1_netlink.h w1: optional bundling of netlink kernel replies 2014-05-27 13:56:21 -07:00