Add the missing sanity check on the size of interrupt-in transfers to
avoid parsing stale or uninitialised slab data (and leaking it to user
space).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/serial/mct_u232.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index ca1530da6e77..163161881d2d 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -544,6 +544,11 @@ static void mct_u232_read_int_callback(struct urb *urb)
 		goto exit;
 	}
 
+	if (urb->actual_length < 2) {
+		dev_warn_ratelimited(&port->dev, "short interrupt-in packet\n");
+		goto exit;
+	}
+
 	/*
 	 * The interrupt-in pipe signals exceptional conditions (modem line
 	 * signal changes and errors). data[0] holds MSR, data[1] holds LSR.
-- 
2.53.0

On Wed, May 20, 2026 at 12:17:50PM +0200, Johan Hovold wrote:
> Add the missing sanity check on the size of interrupt-in transfers to
> avoid parsing stale or uninitialised slab data (and leaking it to user
> space).
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/usb/serial/mct_u232.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
> index ca1530da6e77..163161881d2d 100644
> --- a/drivers/usb/serial/mct_u232.c
> +++ b/drivers/usb/serial/mct_u232.c
> @@ -544,6 +544,11 @@ static void mct_u232_read_int_callback(struct urb *urb)
>  		goto exit;
>  	}
>  
> +	if (urb->actual_length < 2) {
> +		dev_warn_ratelimited(&port->dev, "short interrupt-in packet\n");
> +		goto exit;
> +	}
> +
>  	/*
>  	 * The interrupt-in pipe signals exceptional conditions (modem line
>  	 * signal changes and errors). data[0] holds MSR, data[1] holds LSR.
> -- 
> 2.53.0
> 
> 

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>