Linux USB
 help / color / mirror / Atom feed
* [PATCH] USB: serial: keyspan: fix missing indat transfer sanity check
@ 2026-05-20 10:12 Johan Hovold
  2026-05-20 11:17 ` Greg Kroah-Hartman
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Johan Hovold @ 2026-05-20 10:12 UTC (permalink / raw)
  To: Johan Hovold; +Cc: Greg Kroah-Hartman, linux-usb, linux-kernel, stable

Add the missing sanity check on the size of usa49wg indat transfers to
avoid parsing stale or uninitialised slab data.

Fixes: 0ca1268e109a ("USB Serial Keyspan: add support for USA-49WG & USA-28XG")
Cc: stable@vger.kernel.org	# 2.6.23
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/serial/keyspan.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 46448843541a..a267bc51afc1 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -1187,6 +1187,10 @@ static void usa49wg_indat_callback(struct urb *urb)
 	len = 0;
 
 	while (i < urb->actual_length) {
+		if (urb->actual_length - i < 3) {
+			dev_warn_ratelimited(&serial->dev, "malformed indat packet\n");
+			break;
+		}
 
 		/* Check port number from message */
 		if (data[i] >= serial->num_ports) {
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-05-20 18:58 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-20 10:12 [PATCH] USB: serial: keyspan: fix missing indat transfer sanity check Johan Hovold
2026-05-20 11:17 ` Greg Kroah-Hartman
2026-05-20 14:01 ` Johan Hovold
2026-05-20 17:42 ` kernel test robot
2026-05-20 18:57 ` kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox