diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-05-22 10:30:21 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-06-06 21:05:15 -0700 |
| commit | 403b0a6970b1084bb27907c0f8225801fdd0fe1d (patch) | |
| tree | 174d0be63b6458d1144cf7251dc2b6633677fef0 /rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git | |
| parent | baf56975806534268e24acf9a8abb1c447ce11e9 (diff) | |
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
The debug logging in ims_pcu_irq() unconditionally prints data from
pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the
actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the
control URB exceeds pcu->max_in_size, this leads to an out-of-bounds
read.
Fix this by printing from the correct buffer associated with the URB.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions