diff options
| author | Josh Boyer <jwboyer@fedoraproject.org> | 2016-01-12 13:12:57 -0500 |
|---|---|---|
| committer | Josh Boyer <jwboyer@fedoraproject.org> | 2016-01-12 13:13:04 -0500 |
| commit | 0c2a2f5349cef63c6a8d4bb53593fae904912054 (patch) | |
| tree | dc1a8a37f58535a06a04bcf519e3c39b821320be /usb-serial-visor-fix-crash-on-detecting-device-witho.patch | |
| parent | c40143140b423e2fccbe0d971289a85b66af1cf7 (diff) | |
| download | kernel-0c2a2f5349cef63c6a8d4bb53593fae904912054.tar.gz kernel-0c2a2f5349cef63c6a8d4bb53593fae904912054.tar.xz kernel-0c2a2f5349cef63c6a8d4bb53593fae904912054.zip | |
CVE-2015-7566 usb: visor: Crash on invalid USB dev descriptors (rhbz 1296466 1297517)
Diffstat (limited to 'usb-serial-visor-fix-crash-on-detecting-device-witho.patch')
| -rw-r--r-- | usb-serial-visor-fix-crash-on-detecting-device-witho.patch | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/usb-serial-visor-fix-crash-on-detecting-device-witho.patch b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch new file mode 100644 index 000000000..ddd4fc5b9 --- /dev/null +++ b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch @@ -0,0 +1,36 @@ +From b2476fe4c16be5c2b7ee950e50677cfaa9ab9bae Mon Sep 17 00:00:00 2001 +From: Vladis Dronov <vdronov@redhat.com> +Date: Tue, 12 Jan 2016 14:10:50 -0500 +Subject: [PATCH] usb: serial: visor: fix crash on detecting device without + write_urbs + +The visor driver crashes in clie_5_attach() when a specially crafted USB +device without bulk-out endpoint is detected. This fix adds a check that +the device has proper configuration expected by the driver. + +Reported-by: Ralf Spenneberg <ralf@spenneberg.net> +Signed-off-by: Vladis Dronov <vdronov@redhat.com> +--- + drivers/usb/serial/visor.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c +index 60afb39eb73c..bbc90c059002 100644 +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_serial *serial) + */ + + /* some sanity check */ +- if (serial->num_ports < 2) +- return -1; ++ if (serial->num_bulk_out < 2) { ++ dev_err(&serial->interface->dev, "missing bulk out endpoints\n"); ++ return -ENODEV; ++ } + + /* port 0 now uses the modified endpoint Address */ + port = serial->port[0]; +-- +2.5.0 + |