USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data (and leaking it to user space).

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")

Cc [email protected]

Signed-off-by Johan Hovold <[email protected]>

---
 drivers/usb/serial/mct_u232.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/usb/serial/mct_u232.c +5 -0

index ca1530da6e77..163161881d2d 100644
@@ -544,6 +544,11 @@ static void mct_u232_read_int_callback(struct urb *urb)
 		goto exit;
 	}
 
+	if (urb->actual_length < 2) {
+		dev_warn_ratelimited(&port->dev, "short interrupt-in packet\n");
+		goto exit;
+	}
+
 	/*
 	 * The interrupt-in pipe signals exceptional conditions (modem line
 	 * signal changes and errors). data[0] holds MSR, data[1] holds LSR.

Signature · 1 line

2.53.0