Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Jann Horn 6878c61a38 usb: cdc-acm: Fix handling of oversized fragments ... commit 12e712964f upstream. If we receive an initial fragment of size 8 bytes which specifies a wLength of 1 byte (so the reassembled message is supposed to be 9 bytes long), and we then receive a second fragment of size 9 bytes (which is not supposed to happen), we currently wrongly bypass the fragment reassembly code but still pass the pointer to the acm->notification_buffer to acm_process_notification(). Make this less wrong by always going through fragment reassembly when we expect more fragments. Before this patch, receiving an overlong fragment could lead to `newctrl` in acm_process_notification() being uninitialized data (instead of data coming from the device). Cc: stable <stable@kernel.org> Fixes: ea2583529c ("cdc-acm: reassemble fragmented notifications") Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2025-03-13 12:50:39 +01:00
..
cdc-acm.c	usb: cdc-acm: Fix handling of oversized fragments	2025-03-13 12:50:39 +01:00
cdc-acm.h	USB: cdc-acm: fix minor-number release	2021-09-14 10:33:40 +02:00
cdc-wdm.c	USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages	2024-07-05 09:14:14 +02:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	USB: add SPDX identifiers to all remaining Makefiles	2017-11-07 15:53:48 +01:00
usblp.c	USB: usblp: return error when setting unsupported protocol	2025-01-23 17:15:53 +01:00
usbtmc.c	USB: usbtmc: prevent kernel-usb-infoleak	2024-10-17 15:10:42 +02:00