Jann Horn 12e712964f
usb: cdc-acm: Fix handling of oversized fragments ...
If we receive an initial fragment of size 8 bytes which specifies a wLength
of 1 byte (so the reassembled message is supposed to be 9 bytes long), and
we then receive a second fragment of size 9 bytes (which is not supposed to
happen), we currently wrongly bypass the fragment reassembly code but still
pass the pointer to the acm->notification_buffer to
acm_process_notification().
Make this less wrong by always going through fragment reassembly when we
expect more fragments.
Before this patch, receiving an overlong fragment could lead to `newctrl`
in acm_process_notification() being uninitialized data (instead of data
coming from the device).
Cc: stable <stable@kernel.org >
Fixes: ea2583529cjannh@google.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2025-02-14 09:22:15 +01:00
2025-01-26 17:50:53 -08:00
2025-02-01 09:49:20 -08:00
2025-01-27 16:51:51 -08:00
2025-01-31 11:07:56 -08:00
2025-01-24 08:03:52 -08:00
2025-01-31 15:13:25 -08:00
2025-01-31 11:49:30 -08:00
2025-01-29 15:23:49 -05:00
2025-01-28 12:25:12 -08:00
2025-01-28 13:48:37 +01:00
2025-01-10 15:43:16 +01:00
2025-01-28 13:48:37 +01:00
2025-01-26 18:36:23 -08:00
2025-01-10 00:54:21 +00:00
2025-01-29 10:56:11 +01:00
2025-01-30 15:10:34 -08:00
2025-01-28 12:25:12 -08:00
2025-01-29 11:23:22 -08:00
2025-01-13 20:48:34 +01:00
2025-01-29 14:29:57 -08:00
2025-01-21 09:38:52 -08:00
2025-01-12 13:44:27 +01:00
2025-01-28 12:25:12 -08:00
2025-01-31 09:17:02 -08:00
2025-01-09 10:56:57 +01:00
2025-01-30 10:19:30 -08:00
2025-01-31 15:45:41 -08:00
2025-01-25 16:03:40 -08:00
2025-01-28 13:48:37 +01:00
2025-01-28 12:25:12 -08:00
2025-01-28 09:01:36 -08:00
2025-01-30 17:43:36 -08:00
2025-01-24 15:48:01 -08:00
2025-01-22 11:16:14 -08:00
2025-01-16 13:46:08 +01:00
2025-01-26 17:50:53 -08:00
2025-01-24 07:18:39 -08:00
2025-01-16 14:01:40 +01:00
2025-01-25 09:22:55 -08:00
2025-01-25 18:15:32 +08:00
2025-01-28 12:25:12 -08:00
2025-01-26 18:36:23 -08:00
2025-01-18 16:20:55 -06:00
2025-01-31 11:49:30 -08:00
2025-02-01 09:15:01 -08:00
2025-01-15 19:07:39 +01:00
2025-01-27 16:51:51 -08:00
2025-01-10 15:20:30 -05:00
2025-01-22 09:16:02 -08:00
2025-01-28 13:48:37 +01:00
2025-01-22 10:39:17 -08:00
2025-01-31 11:49:30 -08:00
2025-01-10 10:15:04 +01:00
2025-01-30 12:24:20 -08:00
2025-01-18 17:10:05 -08:00
2025-01-18 14:38:49 -06:00
2025-01-31 07:20:08 -07:00
2025-01-10 16:16:48 +01:00
2025-01-28 12:25:12 -08:00
2025-01-28 12:25:12 -08:00
2025-01-27 12:55:12 -06:00
2025-01-28 13:48:37 +01:00
2025-01-29 14:32:38 -08:00
2025-01-24 07:38:50 -08:00
2025-01-27 16:29:16 -08:00
2025-01-21 10:45:24 +01:00
2025-01-27 15:37:16 -08:00
2025-01-10 16:12:33 +01:00
2025-01-30 12:24:20 -08:00
2025-01-28 12:25:12 -08:00
2025-01-08 10:59:44 +01:00
2025-01-29 11:56:55 -08:00
2025-01-15 10:04:27 -07:00
2025-01-24 14:56:59 -08:00
2025-01-30 17:50:02 -08:00
2025-01-30 10:48:17 -08:00
2025-01-31 11:49:30 -08:00
2025-01-28 12:25:12 -08:00
2025-01-25 15:59:46 -08:00
2025-01-29 14:38:19 -08:00
2025-01-24 16:12:12 -08:00
2025-01-17 12:58:49 +01:00
2025-01-28 12:25:12 -08:00
2025-01-26 16:12:44 -08:00
2025-01-20 13:10:15 +01:00
2025-01-28 12:25:12 -08:00
2025-01-28 12:25:12 -08:00
2025-01-31 11:49:30 -08:00
2025-01-27 16:51:51 -08:00
2025-02-14 09:22:15 +01:00
2025-01-27 15:26:06 -08:00
2025-01-28 14:16:46 -08:00
2025-01-27 09:39:25 -05:00
2025-01-24 11:32:13 -08:00
2025-01-21 09:00:31 -08:00
2025-01-27 15:26:06 -08:00
2025-01-09 10:54:19 +01:00
2025-01-25 16:19:10 -08:00
2025-01-29 11:39:20 -08:00
2025-01-08 18:04:36 +01:00
12e712964f