[PATCH] USB: serial: sierra: validate URB length in instat callback

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

sierra_instat_callback() reads one byte past the usb_ctrlrequest
header at offset sizeof(struct usb_ctrlrequest) without first
checking that urb->actual_length is large enough to contain it.
A short USB interrupt transfer could cause an out-of-bounds read.

Add a length check matching the pattern already present in the
option driver (option_instat_callback), which validates the same
field access.

Fixes: 033a3fb980b041 ("USB: Sierra Wireless driver update")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/usb/serial/sierra.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 6e443aacae07d..8f800cde25229 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -575,6 +575,11 @@ static void sierra_instat_callback(struct urb *urb)
 				__func__);
 			return;
 		}
+		if (urb->actual_length < sizeof(*req_pkt) + 1) {
+			dev_dbg(&port->dev, "%s: short interrupt transfer\n",
+				__func__);
+			return;
+		}
 		if ((req_pkt->bRequestType == 0xA1) &&
 				(req_pkt->bRequest == 0x20)) {
 			int old_dcd_state;
-- 
2.47.3