mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-31 22:34:33 +01:00
Quentin Casasnovas
0d3bba0287
Phil and I found out a problem with commit:7e860a6e7a("cdc-acm: add sanity checks") It added some sanity checks to ignore potential garbage in CDC headers but also introduced a potential infinite loop. This can happen at the first loop iteration (elength = 0 in that case) if the description isn't a DT_CS_INTERFACE or later if 'buffer[0]' is zero. It should also be noted that the wrong length was being added to 'buffer' in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was assigned after that check in the loop. A specially crafted USB device could be used to trigger this infinite loop. Fixes:7e860a6e7a("cdc-acm: add sanity checks") Signed-off-by: Phil Turnbull <[email protected]> Signed-off-by: Quentin Casasnovas <[email protected]> CC: Sergei Shtylyov <[email protected]> CC: Oliver Neukum <[email protected]> CC: Adam Lee <[email protected]> CC: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>