{"push_id":2382109943,"size":1,"distinct_size":1,"ref":"refs/heads/caf/aosp-common/android-4.9-o-release","head":"50d5695a061951f47a686b48c81e579b11297342","before":"aaba28ba79ab4b1788305b1b65008ac2210139c9","commits":[{"sha":"50d5695a061951f47a686b48c81e579b11297342","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"USB: uas: fix bug in handling of alternate settings\n\ncommit 786de92b3cb26012d3d0f00ee37adf14527f35c4 upstream.\n\nThe uas driver has a subtle bug in the way it handles alternate\nsettings.  The uas_find_uas_alt_setting() routine returns an\naltsetting value (the bAlternateSetting number in the descriptor), but\nuas_use_uas_driver() then treats that value as an index to the\nintf->altsetting array, which it isn't.\n\nNormally this doesn't cause any problems because the various\nalternate settings have bAlternateSetting values 0, 1, 2, ..., so the\nvalue is equal to the index in the array.  But this is not guaranteed,\nand Andrey Konovalov used the syzkaller fuzzer with KASAN to get a\nslab-out-of-bounds error by violating this assumption.\n\nThis patch fixes the bug by making uas_find_uas_alt_setting() return a\npointer to the altsetting entry rather than either the value or the\nindex.  Pointers are less subject to misinterpretation.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCC: Oliver Neukum <oneukum@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/50d5695a061951f47a686b48c81e579b11297342"}]}
{"actor":{"display_login":"akhilnarang"}}