]> www.infradead.org Git - users/jedix/linux-maple.git/commit
usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()
authorShuah Khan (Samsung OSG) <shuah@kernel.org>
Fri, 5 Oct 2018 22:17:44 +0000 (16:17 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 10 Nov 2018 15:48:35 +0000 (07:48 -0800)
commit89cd15c962405428bcd11c5f34127698f29bbd60
tree50af154dbda241a63d2c6b07f25ae3e60bd15144
parent6f053e36bda96461245d0d01f374dac4f7cab54c
usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()

commit 81f7567c51ad97668d1c3a48e8ecc482e64d4161 upstream.

vhci_hub_control() accesses port_status array with out of bounds port
value. Fix it to reference port_status[] only with a valid rhport value
when invalid_rhport flag is true.

The invalid_rhport flag is set early on after detecting in port value
is within the bounds or not.

The following is used reproduce the problem and verify the fix:
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14ed8ab6400000

Reported-by: syzbot+bccc1fe10b70fadc78d0@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/usbip/vhci_hcd.c