Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp850045pja; Wed, 1 Apr 2020 09:49:19 -0700 (PDT) X-Google-Smtp-Source: ADFU+vs1Km24Fajd/A68tfjD/j8fMWYjBKccvFO+EGgGiDokGCcFV5pO1pGaFsGkAQYF6qMesWTd X-Received: by 2002:a9d:525:: with SMTP id 34mr7454932otw.80.1585759759102; Wed, 01 Apr 2020 09:49:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759759; cv=none; d=google.com; s=arc-20160816; b=nWey2EBvczpNcDmkwtUoSc/suKsaEGtQEWTgcs6B8ohPcCDWRcbZa2Rqo9APcXMOt0 25L+dqH6oGca3asbFW/yankIP37RMiw8ns+UrEJ+OmOdjOCI6vChomXWBuiUC+OiZHtM Bw183ieK0SMelezTAR5BshoVe9bHb4I7OSlfpBToYUJTLadG7trPhPBV3gXuYEXSOOIl RbQH8QAVgG/J7NInW8XQeHfe3hKE9eAGRnnOcu4bglUElMOaCdw8iM0tOtYHqOik9VKw lqe5Qs/3AWNVM02FQ0jEcyA5kqDC+Pay1wldpfICOX7FLYPxpHpfOu+s1y4/0FtzDdQf 0k3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=kwPCpnaP0Dlt7qfnWewoca8s6SFQILZyNKoxlJ+i4CI=; b=jmQz9Jn3MTNqnfDGMhqijxFIrViw3xuQxv+ApWcknBBxqSbM2tkiHv8fveKHU/1DFf 9NLrlRZk6vkIQfJFRrlEIrA7rv2EbJAp60L6/N3Na6YNqGCtJ1GgM5h8TqtqaMUtx9sO WVAUPs15SbLSpiuvKWfo3FX4yBqZVLc/s48w7F+UBiuDa8AmPBR63WqcFiyB64CCUTNr 7PQmM08uWMhNexPrhd+trs9TCvwRgywO8rD1tneL4OSsrtW2IhjR17bQmO8emaR9c0FW R/JOxsncQhRysghQXL0ZNq+0NYp158tmRvfdDceMNzS//Ae8Axgf7wnfEZhTzr0G3h2p Cgcw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=bacYpaSu; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z29si985371oog.56.2020.04.01.09.49.06; Wed, 01 Apr 2020 09:49:19 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=bacYpaSu; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390113AbgDAQsD (ORCPT + 99 others); Wed, 1 Apr 2020 12:48:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:49952 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390106AbgDAQsB (ORCPT ); Wed, 1 Apr 2020 12:48:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B84332063A; Wed, 1 Apr 2020 16:47:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759680; bh=IKlBNIhNGOdSwMXMGcHYdw2UJo0lDoL6NaGMlLD0S+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bacYpaSu1polefpnhBmbzrniEhuP3dPypknyXcehCZUzk81ofjUAGNT5ThaSX4ox3 5U9xO70MwWYvqHk1rQ8YSdH+ZueTvH9Cyh82ud7+W8FvdiWBYxM5SBdYtopJYjfgfA L3O6W6zhdlLaNQJkv+W6oQml/8/o5gVOv5v63ftA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qiujun Huang , Johan Hovold , syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com Subject: [PATCH 4.14 118/148] USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback Date: Wed, 1 Apr 2020 18:18:30 +0200 Message-Id: <20200401161603.801803678@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Qiujun Huang commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream. Fix slab-out-of-bounds read in the interrupt-URB completion handler. The boundary condition should be (length - 1) as we access data[position + 1]. Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/io_edgeport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -714,7 +714,7 @@ static void edge_interrupt_callback(stru /* grab the txcredits for the ports if available */ position = 2; portNumber = 0; - while ((position < length) && + while ((position < length - 1) && (portNumber < edge_serial->serial->num_ports)) { txCredits = data[position] | (data[position+1] << 8); if (txCredits) {