Johan Hovold 654b404f2a USB: serial: io_ti: fix information leak in completion handler
Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that can be triggered by a malicious device.

This avoids leaking 128 kB of memory content from after the URB transfer
buffer to user space.

Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>	# 2.6.30
Signed-off-by: Johan Hovold <johan@kernel.org>
2017-03-08 16:14:39 +01:00
..
2017-02-22 11:15:59 -08:00
2015-12-18 09:30:34 -08:00
2017-01-26 09:49:13 +01:00
2016-05-20 21:12:25 -07:00
2017-01-26 09:49:13 +01:00
2017-02-09 13:57:05 +01:00
2017-01-26 09:49:13 +01:00