patch "USB: serial: iuu_phoenix: fix memory corruption" added to usb-linus

This is a note to let you know that I've just added the patch titled

USB: serial: iuu_phoenix: fix memory corruption

to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From e7b931bee739e8a77ae216e613d3b99342b6dec0 Mon Sep 17 00:00:00 2001
From: Johan Hovold <[email protected]>
Date: Wed, 15 Jul 2020 11:02:45 +0200
Subject: USB: serial: iuu_phoenix: fix memory corruption

The driver would happily overwrite its write buffer with user data in 256 byte increments due to a removed buffer-space sanity check.

---
 drivers/usb/serial/iuu_phoenix.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

index d5bff69b1769..b8dfeb4fb2ed 100644
@@ -697,14 +697,16 @@ static int iuu_uart_write(struct tty_struct *tty, struct usb_serial_port *port,
 	struct iuu_private *priv = usb_get_serial_port_data(port);
 	unsigned long flags;
 
-	if (count > 256)
-		return -ENOMEM;
-
 	spin_lock_irqsave(&priv->lock, flags);
 
+	count = min(count, 256 - priv->writelen);
+	if (count == 0)
+		goto out;
+
 	/* fill the buffer */
 	memcpy(priv->writebuf + priv->writelen, buf, count);
 	priv->writelen += count;
+out:
 	spin_unlock_irqrestore(&priv->lock, flags);
 
 	return count;

2.27.0