a0dbf15833
commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream.
Fix slab-out-of-bounds read in the interrupt-URB completion handler.
The boundary condition should be (length - 1) as we access
data[position + 1].
Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Fixes:
|
||
---|---|---|
.. | ||
aircable.c | ||
ark3116.c | ||
belkin_sa.c | ||
belkin_sa.h | ||
bus.c | ||
ch341.c | ||
console.c | ||
cp210x.c | ||
cyberjack.c | ||
cypress_m8.c | ||
cypress_m8.h | ||
digi_acceleport.c | ||
empeg.c | ||
ezusb_convert.pl | ||
f81232.c | ||
f81534.c | ||
ftdi_sio.c | ||
ftdi_sio.h | ||
ftdi_sio_ids.h | ||
garmin_gps.c | ||
generic.c | ||
io_16654.h | ||
io_edgeport.c | ||
io_edgeport.h | ||
io_ionsp.h | ||
io_ti.c | ||
io_ti.h | ||
io_usbvend.h | ||
ipaq.c | ||
ipw.c | ||
ir-usb.c | ||
iuu_phoenix.c | ||
iuu_phoenix.h | ||
Kconfig | ||
keyspan.c | ||
keyspan_pda.c | ||
keyspan_usa26msg.h | ||
keyspan_usa28msg.h | ||
keyspan_usa49msg.h | ||
keyspan_usa67msg.h | ||
keyspan_usa90msg.h | ||
kl5kusb105.c | ||
kl5kusb105.h | ||
kobil_sct.c | ||
kobil_sct.h | ||
Makefile | ||
Makefile-keyspan_pda_fw | ||
mct_u232.c | ||
mct_u232.h | ||
metro-usb.c | ||
mos7720.c | ||
mos7840.c | ||
mxuport.c | ||
navman.c | ||
omninet.c | ||
opticon.c | ||
option.c | ||
oti6858.c | ||
oti6858.h | ||
pl2303.c | ||
pl2303.h | ||
qcaux.c | ||
qcserial.c | ||
quatech2.c | ||
safe_serial.c | ||
sierra.c | ||
spcp8x5.c | ||
ssu100.c | ||
symbolserial.c | ||
ti_usb_3410_5052.c | ||
upd78f0730.c | ||
usb-serial-simple.c | ||
usb-serial.c | ||
usb-wwan.h | ||
usb_debug.c | ||
usb_wwan.c | ||
visor.c | ||
visor.h | ||
whiteheat.c | ||
whiteheat.h | ||
wishbone-serial.c | ||
xsens_mt.c |