Messages in this thread | | | Date | Thu, 26 Mar 2020 09:14:33 +0100 | From | Greg KH <> | Subject | Re: [PATCH] USB: io_edgeport: fix slab-out-of-bounds Read in edge_interrupt_callback |
| |
On Wed, Mar 25, 2020 at 03:52:37PM +0800, Qiujun Huang wrote: > The boundary condition should be (length - 1) as we access data[position+1]. > > Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com > Signed-off-by: Qiujun Huang <hqjagain@gmail.com> > --- > drivers/usb/serial/io_edgeport.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c > index 5737add..4cca0b8 100644 > --- a/drivers/usb/serial/io_edgeport.c > +++ b/drivers/usb/serial/io_edgeport.c > @@ -710,7 +710,7 @@ static void edge_interrupt_callback(struct urb *urb) > /* grab the txcredits for the ports if available */ > position = 2; > portNumber = 0; > - while ((position < length) && > + while ((position < length - 1) && > (portNumber < edge_serial->serial->num_ports)) { > txCredits = data[position] | (data[position+1] << 8); > if (txCredits) { > -- > 1.8.3.1 >
Johan, any objection from me taking this in my tree now?
thanks,
greg k-h
| |