Qiujun Huang a2f1111f27 USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback ...

commit 57aa9f294b upstream.

Fix slab-out-of-bounds read in the interrupt-URB completion handler.

The boundary condition should be (length - 1) as we access
data[position + 1].

Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-04-02 17:20:36 +02:00

..

aircable.c

…

ark3116.c

…

belkin_sa.c

…

belkin_sa.h

…

bus.c

…

ch341.c

USB: serial: ch341: handle unbound port at reset_resume

2020-01-23 08:19:39 +01:00

console.c

…

cp210x.c

usb-serial: cp201x: support Mark-10 digital force gauge

2019-11-28 18:29:05 +01:00

cyberjack.c

…

cypress_m8.c

USB: serial: cypress_m8: fix interrupt-out transfer length

2019-11-25 09:53:31 +01:00

cypress_m8.h

…

digi_acceleport.c

…

empeg.c

…

ezusb_convert.pl

…

f81232.c

USB: serial: f81232: fix interrupt worker not stop

2019-05-10 17:52:10 +02:00

ftdi_sio_ids.h

USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P

2019-12-05 15:35:20 +01:00

ftdi_sio.c

USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P

2019-12-05 15:35:20 +01:00

ftdi_sio.h

…

garmin_gps.c

…

generic.c

USB: serial: fix unthrottle races

2019-05-16 19:43:40 +02:00

io_16654.h

…

io_edgeport.c

USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback

2020-04-02 17:20:36 +02:00

io_edgeport.h

…

io_ionsp.h

…

io_tables.h

…

io_ti.c

…

io_ti.h

USB: serial: io_ti: fix array underflow in completion handler

2018-09-26 08:36:36 +02:00

io_usbvend.h

…

ipaq.c

…

ipw.c

…

ir-usb.c

USB: serial: ir-usb: fix IrLAP framing

2020-02-05 13:05:36 +00:00

iuu_phoenix.c

…

iuu_phoenix.h

…

Kconfig

USB: serial: simple: add libtransistor console

2018-05-01 15:13:04 -07:00

keyspan_pda.c

USB: serial: keyspan_pda: fix modem-status error handling

2018-07-17 11:37:52 +02:00

keyspan_usa26msg.h

…

keyspan_usa28msg.h

…

keyspan_usa49msg.h

…

keyspan_usa67msg.h

…

keyspan_usa90msg.h

…

keyspan.c

USB: serial: keyspan: handle unbound ports

2020-01-23 08:19:40 +01:00

keyspan.h

…

kl5kusb105.c

…

kl5kusb105.h

…

kobil_sct.c

USB: serial: kobil_sct: fix modem-status error handling

2018-10-03 17:01:42 -07:00

kobil_sct.h

…

Makefile

…

Makefile-keyspan_pda_fw

…

mct_u232.c

…

mct_u232.h

…

metro-usb.c

…

mos7720.c

USB: serial: mos7720: fix remote wakeup

2019-11-28 18:29:05 +01:00

mos7840.c

USB: serial: mos7840: fix remote wakeup

2019-11-28 18:29:05 +01:00

mxuport.c

…

navman.c

…

omninet.c

…

opticon.c

USB: serial: opticon: fix control-message timeouts

2020-01-23 08:19:39 +01:00

option.c

USB: serial: option: add Wistron Neweb D19Q1

2020-04-02 17:20:36 +02:00

oti6858.c

…

oti6858.h

…

pl2303.c

USB: serial: pl2303: add device-id for HP LD381

2020-04-02 17:20:23 +02:00

pl2303.h

USB: serial: pl2303: add device-id for HP LD381

2020-04-02 17:20:23 +02:00

qcaux.c

…

qcserial.c

…

quatech2.c

USB: serial: quatech2: handle unbound ports

2020-01-23 08:19:39 +01:00

safe_serial.c

…

sierra.c

USB: serial: sierra: fix potential deadlock at close

2018-08-22 07:47:15 +02:00

spcp8x5.c

…

ssu100.c

…

symbolserial.c

…

ti_usb_3410_5052.c

USB: serial: ti_usb_3410_5052: fix port-close races

2019-10-29 09:15:16 +01:00

usb_debug.c

…

usb_wwan.c

USB: serial: option: add ZLP support for 0x1bc7/0x9010

2020-01-14 20:04:29 +01:00

usb-serial-simple.c

USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx

2020-01-23 08:19:39 +01:00

usb-serial.c

USB: serial: suppress driver bind attributes

2020-01-23 08:19:39 +01:00

usb-wwan.h

USB: serial: option: add ZLP support for 0x1bc7/0x9010

2020-01-14 20:04:29 +01:00

visor.c

USB: serial: visor: handle potential invalid device configuration

2018-05-09 09:50:23 +02:00

visor.h

…

whiteheat.c

USB: serial: whiteheat: fix line-speed endianness

2019-11-06 12:18:20 +01:00

whiteheat.h

USB: serial: whiteheat: fix line-speed endianness

2019-11-06 12:18:20 +01:00

wishbone-serial.c

…

xsens_mt.c

…