ACK: [CVE-2017-8924][PATCH T/Y] USB: serial: io_ti: fix information leak in completion handler

[Stefan Bader]

On 12.06.2017 09:14, Po-Hsu Lin wrote:
> From: Johan Hovold <johan at kernel.org>
> 
> CVE-2017-8924
> 
> Add missing sanity check to the bulk-in completion handler to avoid an
> integer underflow that can be triggered by a malicious device.
> 
> This avoids leaking 128 kB of memory content from after the URB transfer
> buffer to user space.
> 
> Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32")
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable <stable at vger.kernel.org>	# 2.6.30
> Signed-off-by: Johan Hovold <johan at kernel.org>
> (cherry picked from commit 654b404f2a222f918af9b0cd18ad469d0c941a8e)
> 
> Signed-off-by: Po-Hsu Lin <po-hsu.lin at canonical.com>

Acked-by: Stefan Bader <stefan.bader at canonical.com>

> ---
>  drivers/usb/serial/io_ti.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
> index 0385bc4..8c2b58a 100644
> --- a/drivers/usb/serial/io_ti.c
> +++ b/drivers/usb/serial/io_ti.c
> @@ -1653,7 +1653,7 @@ static void edge_bulk_in_callback(struct urb *urb)
>  
>  	port_number = edge_port->port->port_number;
>  
> -	if (edge_port->lsr_event) {
> +	if (urb->actual_length > 0 && edge_port->lsr_event) {
>  		edge_port->lsr_event = 0;
>  		dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
>  			__func__, port_number, edge_port->lsr_mask, *data);
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20170612/df75bd47/attachment.sig>