Messages in this thread Patch in this message | | | From | sathyanarayanan.kuppuswamy@linux ... | Subject | [PATCH v1 1/1] USB: serial: Add boundry check for read_urbs array access | Date | Wed, 7 Mar 2018 12:23:56 -0800 |
| |
From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
In usb_serial_generic_submit_read_urb() function we are accessing the port->read_urbs array without any boundry checks. This might lead to kernel panic when index value goes above array length.
One posible call path for this issue is,
usb_serial_generic_read_bulk_callback() { ... if (!port->throttled) { usb_serial_generic_submit_read_urb(port, i, GFP_ATOMIC); ... }
This patch fixes this issue.
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> --- drivers/usb/serial/generic.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c index 2274d96..72ebdde 100644 --- a/drivers/usb/serial/generic.c +++ b/drivers/usb/serial/generic.c @@ -306,6 +306,9 @@ static int usb_serial_generic_submit_read_urb(struct usb_serial_port *port, { int res; + if (index >= ARRAY_SIZE(port->read_urbs)) + return -EINVAL; + if (!test_and_clear_bit(index, &port->read_urbs_free)) return 0; -- 2.7.4
| |