Hui Peng 49be8dc589 USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data ...

commit 5146f95df7 upstream.

The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data.

Add a length check for both locations and updated hso_probe to bail on
error.

This issue has been assigned CVE-2018-19985.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-12-29 13:39:08 +01:00

..

appletalk

net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

2018-09-29 03:06:00 -07:00

arcnet

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bonding

bonding: fix 802.3ad state sent to partner when unbinding slave

2018-12-21 14:13:12 +01:00

caif

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

can

can: rcar_can: Fix erroneous registration

2018-12-13 09:18:46 +01:00

cris

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

dsa

mv88e6060: disable hardware level MAC learning

2018-12-21 14:13:15 +01:00

ethernet

mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl

2018-12-21 14:13:17 +01:00

fddi

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fjes

networking: introduce and use skb_put_data()

2017-06-16 11:48:37 -04:00

hamradio

yam: fix a missing-check bug

2018-11-04 14:52:41 +01:00

hippi

hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

2018-02-25 11:08:04 +01:00

hyperv

hv_netvsc: fix schedule in RCU context

2018-10-18 09:16:22 +02:00

ieee802154

ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem

2018-08-24 13:09:14 +02:00

ipvlan

ipvlan: call dev_change_flags when ipvlan mode is reset

2018-08-24 13:09:11 +02:00

phy

net: phy: don't allow __set_phy_supported to add unsupported modes

2018-12-17 09:28:46 +01:00

plip

…

ppp

pppoe: fix reception of frames with no mac header

2018-09-29 03:06:00 -07:00

slip

slip: Check if rstate is initialized before uncompressing

2018-04-19 08:56:16 +02:00

team

team: no need to do team_notify_peers or team_mcast_rejoin when disabling port

2018-12-13 09:18:50 +01:00

usb

USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data

2018-12-29 13:39:08 +01:00

vmxnet3

vmxnet3: use DMA memory barriers where required

2018-05-25 16:17:25 +02:00

wan

wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc

2018-09-26 08:38:03 +02:00

wimax

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

wireless

mac80211_hwsim: fix module init error paths for netlink

2018-12-21 14:13:11 +01:00

xen-netback

xen-netback: fix input validation in xenvif_set_hash_mapping()

2018-10-13 09:27:23 +02:00

dummy.c

dummy: Remove references to NETIF_F_UFO.

2017-07-17 09:52:57 -07:00

eql.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

geneve.c

net: fix use-after-free in GRO with ESP

2018-07-22 14:28:44 +02:00

gtp.c

gtp: Initialize 64-bit per-cpu stats correctly

2017-08-01 20:06:07 -07:00

ifb.c

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

Kconfig

x86/lguest: Remove lguest support

2017-08-24 09:57:28 +02:00

LICENSE.SRC

…

loopback.c

net: Fix inconsistent teardown and release of private netdev state.

2017-06-07 15:53:24 -04:00

macsec.c

macsec: fix memory leaks when skb_to_sgvec fails

2017-10-11 14:07:20 -07:00

macvlan.c

macvlan: fix use-after-free in macvlan_common_newlink()

2018-05-30 07:52:02 +02:00

macvtap.c

tap: reference to KVA of an unloaded module causes kernel panic

2017-10-28 19:17:21 +09:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mdio.c

net: mdio: add mdio45_ethtool_ksettings_get

2017-01-02 16:59:10 -05:00

mii.c

net/{mii, smsc}: Make mii_ethtool_get_link_ksettings and smc_netdev_get_ecmd return void

2017-06-05 11:00:42 -04:00

netconsole.c

netconsole: Remove duplicate "netconsole: " logging prefix

2017-06-13 12:57:40 -04:00

nlmon.c

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ntb_netdev.c

ntb_netdev: set the net_device's parent

2017-07-06 11:30:08 -04:00

rionet.c

rapidio/rionet: do not free skb before reading its length

2018-12-05 19:41:17 +01:00

sb1000.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

Space.c

…

sungem_phy.c

drivers/net/sungem: add const to mii_phy_ops structures

2017-06-08 15:32:47 -04:00

tap.c

net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds vlan

2018-06-26 08:06:28 +08:00

tun.c

tun: forbid iface creation with rtnl ops

2018-12-17 09:28:47 +01:00

veth.c

veth: set peer GSO values

2018-03-19 08:42:54 +01:00

virtio_net.c

virtio-net: keep vnet header zeroed after processing XDP

2018-12-17 09:28:47 +01:00

vrf.c

vrf: Fix use after free and double free in vrf_finish_output

2018-04-12 12:32:24 +02:00

vsockmon.c

net: Fix inconsistent teardown and release of private netdev state.

2017-06-07 15:53:24 -04:00

vxlan.c

vxlan: fix default fdb entry netlink notify ordering during netdev create

2018-07-28 07:55:43 +02:00

xen-netfront.c

xen-netfront: Fix mismatched rtnl_unlock

2018-11-04 14:52:44 +01:00