diff options
| -rw-r--r-- | kernel.spec | 4 | ||||
| -rw-r--r-- | usb-serial-visor-fix-crash-on-detecting-device-witho.patch | 36 |
2 files changed, 40 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec index e3b8a0d37..2113d36db 100644 --- a/kernel.spec +++ b/kernel.spec @@ -627,6 +627,9 @@ Patch621: drm-udl-Use-unlocked-gem-unreferencing.patch #rhbz 1083853 Patch622: PNP-Add-Broadwell-to-Intel-MCH-size-workaround.patch +#CVE-2015-7566 rhbz 1296466 1297517 +Patch623: usb-serial-visor-fix-crash-on-detecting-device-witho.patch + # END OF PATCH DEFINITIONS %endif @@ -2071,6 +2074,7 @@ fi # %changelog * Tue Jan 12 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2015-7566 usb: visor: Crash on invalid USB dev descriptors (rhbz 1296466 1297517) - Fix backtrace from PNP conflict on Broadwell (rhbz 1083853) * Mon Jan 11 2016 Laura Abbott <labbott@redhat.com> - 4.4.0-1 diff --git a/usb-serial-visor-fix-crash-on-detecting-device-witho.patch b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch new file mode 100644 index 000000000..ddd4fc5b9 --- /dev/null +++ b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch @@ -0,0 +1,36 @@ +From b2476fe4c16be5c2b7ee950e50677cfaa9ab9bae Mon Sep 17 00:00:00 2001 +From: Vladis Dronov <vdronov@redhat.com> +Date: Tue, 12 Jan 2016 14:10:50 -0500 +Subject: [PATCH] usb: serial: visor: fix crash on detecting device without + write_urbs + +The visor driver crashes in clie_5_attach() when a specially crafted USB +device without bulk-out endpoint is detected. This fix adds a check that +the device has proper configuration expected by the driver. + +Reported-by: Ralf Spenneberg <ralf@spenneberg.net> +Signed-off-by: Vladis Dronov <vdronov@redhat.com> +--- + drivers/usb/serial/visor.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c +index 60afb39eb73c..bbc90c059002 100644 +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_serial *serial) + */ + + /* some sanity check */ +- if (serial->num_ports < 2) +- return -1; ++ if (serial->num_bulk_out < 2) { ++ dev_err(&serial->interface->dev, "missing bulk out endpoints\n"); ++ return -ENODEV; ++ } + + /* port 0 now uses the modified endpoint Address */ + port = serial->port[0]; +-- +2.5.0 + |