Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Subject: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Message-Id: <20181209163245.GA25484@kroah.com>
Date: Sun, 9 Dec 2018 17:32:45 +0100
To: "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org
Cc: linux-usb@vger.kernel.org, Sebastian Andrzej Siewior <bigeasy@linutronix.de>, Hui Peng <benquike@gmail.com>, Mathias Payer <mathias.payer@nebelwelt.net>
List-ID: <linux-usb.vger.kernel.org>

RnJvbTogSHVpIFBlbmcgPGJlbnF1aWtlQGdtYWlsLmNvbT4KClRoZSBmdW5jdGlvbiBoc29fcHJv
YmUgcmVhZHMgaWZfbnVtIGZyb20gdGhlIFVTQiBkZXZpY2UgKGFzIGFuIHU4KSBhbmQgdXNlcwpp
dCB3aXRob3V0IGEgbGVuZ3RoIGNoZWNrIHRvIGluZGV4IGFuIGFycmF5LCByZXN1bHRpbmcgaW4g
YW4gT09CIG1lbW9yeSByZWFkCmluIGhzb19wcm9iZSBvciBoc29fZ2V0X2NvbmZpZ19kYXRhLiBB
ZGRlZCBhIGxlbmd0aCBjaGVjayBmb3IgYm90aCBsb2NhdGlvbnMKYW5kIHVwZGF0ZWQgaHNvX3By
b2JlIHRvIGJhaWwgb24gZXJyb3IuCgpSZXBvcnRlZC1ieTogSHVpIFBlbmcgPGJlbnF1aWtlQGdt
YWlsLmNvbT4KUmVwb3J0ZWQtYnk6IE1hdGhpYXMgUGF5ZXIgPG1hdGhpYXMucGF5ZXJAbmViZWx3
ZWx0Lm5ldD4KU2lnbmVkLW9mZi1ieTogSHVpIFBlbmcgPGJlbnF1aWtlQGdtYWlsLmNvbT4KU2ln
bmVkLW9mZi1ieTogTWF0aGlhcyBQYXllciA8bWF0aGlhcy5wYXllckBuZWJlbHdlbHQubmV0PgpT
aWduZWQtb2ZmLWJ5OiBHcmVnIEtyb2FoLUhhcnRtYW4gPGdyZWdraEBsaW51eGZvdW5kYXRpb24u
b3JnPgotLS0KIGRyaXZlcnMvbmV0L3VzYi9oc28uYyB8IDE4ICsrKysrKysrKysrKysrKystLQog
MSBmaWxlIGNoYW5nZWQsIDE2IGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0pCgpkaWZmIC0t
Z2l0IGEvZHJpdmVycy9uZXQvdXNiL2hzby5jIGIvZHJpdmVycy9uZXQvdXNiL2hzby5jCmluZGV4
IDE4NGMyNGJhY2ExNS4uMTY4ZjkwODFkNGVhIDEwMDY0NAotLS0gYS9kcml2ZXJzL25ldC91c2Iv
aHNvLmMKKysrIGIvZHJpdmVycy9uZXQvdXNiL2hzby5jCkBAIC0yODA3LDYgKzI4MDcsMTIgQEAg
c3RhdGljIGludCBoc29fZ2V0X2NvbmZpZ19kYXRhKHN0cnVjdCB1c2JfaW50ZXJmYWNlICppbnRl
cmZhY2UpCiAJCXJldHVybiAtRUlPOwogCX0KIAorCS8qIGNoZWNrIGlmIHdlIGhhdmUgYSB2YWxp
ZCBpbnRlcmZhY2UgKi8KKwlpZiAoaWZfbnVtID4gMTYpIHsKKwkJa2ZyZWUoY29uZmlnX2RhdGEp
OworCQlyZXR1cm4gLUVJTlZBTDsKKwl9CisKIAlzd2l0Y2ggKGNvbmZpZ19kYXRhW2lmX251bV0p
IHsKIAljYXNlIDB4MDoKIAkJcmVzdWx0ID0gMDsKQEAgLTI4NzcsMTAgKzI4ODMsMTggQEAgc3Rh
dGljIGludCBoc29fcHJvYmUoc3RydWN0IHVzYl9pbnRlcmZhY2UgKmludGVyZmFjZSwKIAogCS8q
IEdldCB0aGUgaW50ZXJmYWNlL3BvcnQgc3BlY2lmaWNhdGlvbiBmcm9tIGVpdGhlciBkcml2ZXJf
aW5mbyBvciBmcm9tCiAJICogdGhlIGRldmljZSBpdHNlbGYgKi8KLQlpZiAoaWQtPmRyaXZlcl9p
bmZvKQorCWlmIChpZC0+ZHJpdmVyX2luZm8pIHsKKwkJLyogaWZfbnVtIGlzIGNvbnRyb2xsZWQg
YnkgdGhlIGRldmljZSwgZHJpdmVyX2luZm8gaXMgYSAwIHRlcm1pbmF0ZWQKKwkJICogYXJyYXku
IE1ha2Ugc3VyZSwgdGhlIGFjY2VzcyBpcyBpbiBib3VuZHMhICovCisJCWZvciAoaSA9IDA7IGkg
PD0gaWZfbnVtOyArK2kpCisJCQlpZiAoKCh1MzIgKikoaWQtPmRyaXZlcl9pbmZvKSlbaV0gPT0g
MCkKKwkJCQlnb3RvIGV4aXQ7CiAJCXBvcnRfc3BlYyA9ICgodTMyICopKGlkLT5kcml2ZXJfaW5m
bykpW2lmX251bV07Ci0JZWxzZQorCX0gZWxzZSB7CiAJCXBvcnRfc3BlYyA9IGhzb19nZXRfY29u
ZmlnX2RhdGEoaW50ZXJmYWNlKTsKKwkJaWYgKElTX0VSUl9WQUxVRSgobG9uZylwb3J0X3NwZWMp
KQorCQkJZ290byBleGl0OworCX0KIAogCS8qIENoZWNrIGlmIHdlIG5lZWQgdG8gc3dpdGNoIHRv
IGFsdCBpbnRlcmZhY2VzIHByaW9yIHRvIHBvcnQKIAkgKiBjb25maWd1cmF0aW9uICovCg==