155b01b6ba
commit b909df18ce2a998afef81d58bbd1a05dc0788c40 upstream.
A bogus device can provide a bNumConfigurations value that exceeds the
initial value used in usb_get_configuration for allocating dev->config.
This can lead to out-of-bounds accesses later, e.g. in
usb_destroy_configuration.
Signed-off-by: Benoît Sevens <bsevens@google.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@kernel.org
Link: https://patch.msgid.link/20241120124144.3814457-1-bsevens@google.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| 6fire | ||
| bcd2000 | ||
| caiaq | ||
| hiface | ||
| line6 | ||
| misc | ||
| usx2y | ||
| card.c | ||
| card.h | ||
| clock.c | ||
| clock.h | ||
| debug.h | ||
| endpoint.c | ||
| endpoint.h | ||
| exynos_usb_audio.c | ||
| exynos_usb_audio.h | ||
| format.c | ||
| format.h | ||
| helper.c | ||
| helper.h | ||
| Kconfig | ||
| Makefile | ||
| media.c | ||
| media.h | ||
| midi.c | ||
| midi.h | ||
| mixer.c | ||
| mixer.h | ||
| mixer_maps.c | ||
| mixer_quirks.c | ||
| mixer_quirks.h | ||
| mixer_s1810c.c | ||
| mixer_s1810c.h | ||
| mixer_scarlett.c | ||
| mixer_scarlett.h | ||
| mixer_scarlett_gen2.c | ||
| mixer_scarlett_gen2.h | ||
| mixer_us16x08.c | ||
| mixer_us16x08.h | ||
| pcm.c | ||
| pcm.h | ||
| power.c | ||
| power.h | ||
| proc.c | ||
| proc.h | ||
| quirks-table.h | ||
| quirks.c | ||
| quirks.h | ||
| stream.c | ||
| stream.h | ||
| usbaudio.h | ||
| validate.c | ||