diff options
author | Ignat Korchagin <ignat.korchagin@gmail.com> | 2016-03-17 18:00:29 +0000 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-05-04 14:48:50 -0700 |
commit | 4a1bb501e4b65908b102f0b371b0621ff18ad5c3 (patch) | |
tree | c6619bd925fcaaa4a6aac6433fca907f4958f65a /drivers/lightnvm | |
parent | 3c6266d57c4c4fa02588070347acf21b610bbd96 (diff) |
USB: usbip: fix potential out-of-bounds write
commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb upstream.
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.
Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/lightnvm')
0 files changed, 0 insertions, 0 deletions