USB: serial: fix potential heap buffer overflow
authorJohan Hovold <johan@kernel.org>
Wed, 27 Aug 2014 09:55:19 +0000 (11:55 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 13 Sep 2014 22:41:47 +0000 (23:41 +0100)
commitb067dfbd9dfa1b9f6b494ea671054f2cbf212ae9
tree65cfd362e874a9302fa4bd0fe1e32cff1061d3be
parent51140f5ce2b7e47934b277a3195cb2f1b78912fc
USB: serial: fix potential heap buffer overflow

commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.

Make sure to verify the number of ports requested by subdriver to avoid
writing beyond the end of fixed-size array in interface data.

The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of ports requested by a
subdriver (which could have been determined from device descriptors) did
not exceed this limit.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: s/ddev/\&interface->dev/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/usb/serial/usb-serial.c