kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-12 06:01:58 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Szymon Heidrich d1a92bb8d6 usb: gadget: uvc: Prevent buffer overflow in setup handler 
commit 4c92670b16 upstream.

Setup function uvc_function_setup permits control transfer
requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),
data stage handler for OUT transfer uses memcpy to copy req->actual
bytes to uvc_event->data.data array of size 60. This may result
in an overflow of 4 bytes.

Fixes: cdda479f15 ("USB gadget: video class function driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20221206141301.51305-1-szymon.heidrich@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2022-12-21 17:48:06 +01:00
..
function usb: gadget: uvc: Prevent buffer overflow in setup handler 2022-12-21 17:48:06 +01:00
legacy gadgetfs: ep_io - wait until IRQ finishes 2022-07-08 14:50:43 +02:00
udc usb: bdc: change state when port disconnected 2022-10-22 12:51:53 +02:00
composite.c USB: gadget: Rename usb_gadget_probe_driver() 2022-04-26 14:00:13 +02:00
config.c usb: fix various gadget panics on 10gbps cabling 2021-06-09 10:40:08 +02:00
configfs.c Linux 5.18-rc5 2022-05-03 16:35:26 +02:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: fix for a typo that conveys logically-inverted information. 2021-09-14 10:27:54 +02:00
functions.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
Kconfig media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
Makefile usb: gadget: Makefile: remove ccflags-y 2022-03-18 12:56:08 +01:00
u_f.c usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
u_f.h USB: gadget: u_f: Unbreak offset calculation in VLAs 2020-08-27 09:25:06 +02:00
u_os_desc.h usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
usbstring.c usb: gadget: fix langid kernel-doc warning in usbstring.c 2020-07-09 10:13:07 +03:00