Patch "USB: serial: keyspan_pda: fix receive sanity checks" has been added to the 4.9-stable tree

Patch "USB: serial: keyspan_pda: fix receive sanity checks" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    USB: serial: keyspan_pda: fix receive sanity checks

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-serial-keyspan_pda-fix-receive-sanity-checks.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From c528fcb116e61afc379a2e0a0f70906b937f1e2c Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 31 Jan 2017 17:17:29 +0100
Subject: USB: serial: keyspan_pda: fix receive sanity checks

From: Johan Hovold <johan@kernel.org>

commit c528fcb116e61afc379a2e0a0f70906b937f1e2c upstream.

Make sure to check for short transfers before parsing the receive buffer
to avoid acting on stale data.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |   19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -139,6 +139,7 @@ static void keyspan_pda_rx_interrupt(str
 {
 	struct usb_serial_port *port = urb->context;
 	unsigned char *data = urb->transfer_buffer;
+	unsigned int len = urb->actual_length;
 	int retval;
 	int status = urb->status;
 	struct keyspan_pda_private *priv;
@@ -159,18 +160,26 @@ static void keyspan_pda_rx_interrupt(str
 		goto exit;
 	}
 
+	if (len < 1) {
+		dev_warn(&port->dev, "short message received\n");
+		goto exit;
+	}
+
 	/* see if the message is data or a status interrupt */
 	switch (data[0]) {
 	case 0:
 		 /* rest of message is rx data */
-		if (urb->actual_length) {
-			tty_insert_flip_string(&port->port, data + 1,
-						urb->actual_length - 1);
-			tty_flip_buffer_push(&port->port);
-		}
+		if (len < 2)
+			break;
+		tty_insert_flip_string(&port->port, data + 1, len - 1);
+		tty_flip_buffer_push(&port->port);
 		break;
 	case 1:
 		/* status interrupt */
+		if (len < 3) {
+			dev_warn(&port->dev, "short interrupt message received\n");
+			break;
+		}
 		dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
 		switch (data[1]) {
 		case 1: /* modemline change */


Patches currently in stable-queue which might be from johan@kernel.org are

queue-4.9/usb-serial-mct_u232-fix-modem-status-error-handling.patch
queue-4.9/usb-serial-ark3116-fix-open-error-handling.patch
queue-4.9/usb-serial-io_edgeport-fix-epic-descriptor-handling.patch
queue-4.9/usb-serial-ti_usb_3410_5052-fix-control-message-error-handling.patch
queue-4.9/usb-serial-keyspan_pda-fix-receive-sanity-checks.patch
queue-4.9/usb-serial-sierra-fix-bogus-alternate-setting-assumption.patch
queue-4.9/usb-serial-ssu100-fix-control-message-error-handling.patch
queue-4.9/usb-serial-digi_acceleport-fix-incomplete-rx-sanity-check.patch
queue-4.9/usb-serial-io_edgeport-fix-descriptor-error-handling.patch
queue-4.9/usb-serial-quatech2-fix-control-message-error-handling.patch
queue-4.9/usb-serial-ftdi_sio-fix-latency-timer-error-handling.patch