![]() vhci_hub_control() accesses port_status array with out of bounds port value. Fix it to reference port_status[] only with a valid rhport value when invalid_rhport flag is true. The invalid_rhport flag is set early on after detecting in port value is within the bounds or not. The following is used reproduce the problem and verify the fix: C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14ed8ab6400000 Reported-by: syzbot+bccc1fe10b70fadc78d0@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
README | ||
stub.h | ||
stub_dev.c | ||
stub_main.c | ||
stub_rx.c | ||
stub_tx.c | ||
usbip_common.c | ||
usbip_common.h | ||
usbip_event.c | ||
vhci.h | ||
vhci_hcd.c | ||
vhci_rx.c | ||
vhci_sysfs.c | ||
vhci_tx.c | ||
vudc.h | ||
vudc_dev.c | ||
vudc_main.c | ||
vudc_rx.c | ||
vudc_sysfs.c | ||
vudc_transfer.c | ||
vudc_tx.c |
TODO: - more discussion about the protocol - testing - review of the userspace interface - document the protocol Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>