35 lines
1.2 KiB
Diff
35 lines
1.2 KiB
Diff
From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
|
|
From: Oliver Neukum <oneukum@suse.com>
|
|
Date: Mon, 14 Mar 2016 15:53:38 +0100
|
|
Subject: [PATCH] digi_acceleport: do sanity checking for the number of ports
|
|
|
|
The driver can be crashed with devices that expose crafted
|
|
descriptors with too few endpoints.
|
|
See:
|
|
http://seclists.org/bugtraq/2016/Mar/61
|
|
|
|
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
|
|
---
|
|
drivers/usb/serial/digi_acceleport.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
|
|
index 12b0e67473ba..c4d4d4547d40 100644
|
|
--- a/drivers/usb/serial/digi_acceleport.c
|
|
+++ b/drivers/usb/serial/digi_acceleport.c
|
|
@@ -1260,6 +1260,11 @@ static int digi_startup(struct usb_serial *serial)
|
|
|
|
spin_lock_init(&serial_priv->ds_serial_lock);
|
|
serial_priv->ds_oob_port_num = serial->type->num_ports;
|
|
+ if (!(serial_priv->ds_oob_port_num == 2 && serial->type == &digi_acceleport_2_device)
|
|
+ && !(serial_priv->ds_oob_port_num == 4 && serial->type == &digi_acceleport_4_device)) {
|
|
+ kfree(serial_priv);
|
|
+ return -EINVAL;
|
|
+ }
|
|
serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
|
|
|
|
ret = digi_port_init(serial_priv->ds_oob_port,
|
|
--
|
|
2.5.0
|
|
|