Re: [PATCH v2] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data

On 2018-12-10 09:04:43 [+0100], Greg KH wrote:

From: Hui Peng <redacted>

The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data. Added a length check for both locations
and updated hso_probe to bail on error.

The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data.

Add a length check for both locations and update hso_probe to bail on
error.

This issue has been assigned CVE-2018-19985.

Reported-by: Hui Peng <redacted>
Reported-by: Mathias Payer <redacted>
Signed-off-by: Hui Peng <redacted>
Signed-off-by: Mathias Payer <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Sebastian