mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
68 lines
2.5 KiB
Diff
68 lines
2.5 KiB
Diff
From bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb Mon Sep 17 00:00:00 2001
|
|
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Date: Tue, 19 Sep 2017 15:07:17 +0200
|
|
Subject: [PATCH] USB: fix out-of-bounds in usb_set_configuration
|
|
|
|
Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
|
|
association descriptor. He writes:
|
|
It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
|
|
descriptor. It's only checked that the size is >= 2 in
|
|
usb_parse_configuration(), so find_iad() might do out-of-bounds access
|
|
to intf_assoc->bInterfaceCount.
|
|
|
|
And he's right, we don't check for crazy descriptors of this type very well, so
|
|
resolve this problem. Yet another issue found by syzkaller...
|
|
|
|
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
|
Tested-by: Andrey Konovalov <andreyknvl@google.com>
|
|
Cc: stable <stable@vger.kernel.org>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
drivers/usb/core/config.c | 14 +++++++++++---
|
|
include/uapi/linux/usb/ch9.h | 1 +
|
|
2 files changed, 12 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
|
|
index 854c8d66cfbef..68b54bd88d1eb 100644
|
|
--- a/drivers/usb/core/config.c
|
|
+++ b/drivers/usb/core/config.c
|
|
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
|
|
|
|
} else if (header->bDescriptorType ==
|
|
USB_DT_INTERFACE_ASSOCIATION) {
|
|
+ struct usb_interface_assoc_descriptor *d;
|
|
+
|
|
+ d = (struct usb_interface_assoc_descriptor *)header;
|
|
+ if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
|
|
+ dev_warn(ddev,
|
|
+ "config %d has an invalid interface association descriptor of length %d, skipping\n",
|
|
+ cfgno, d->bLength);
|
|
+ continue;
|
|
+ }
|
|
+
|
|
if (iad_num == USB_MAXIADS) {
|
|
dev_warn(ddev, "found more Interface "
|
|
"Association Descriptors "
|
|
"than allocated for in "
|
|
"configuration %d\n", cfgno);
|
|
} else {
|
|
- config->intf_assoc[iad_num] =
|
|
- (struct usb_interface_assoc_descriptor
|
|
- *)header;
|
|
+ config->intf_assoc[iad_num] = d;
|
|
iad_num++;
|
|
}
|
|
|
|
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
|
|
index ce1169af39d72..2a5d63040a0b0 100644
|
|
--- a/include/uapi/linux/usb/ch9.h
|
|
+++ b/include/uapi/linux/usb/ch9.h
|
|
@@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor {
|
|
__u8 iFunction;
|
|
} __attribute__ ((packed));
|
|
|
|
+#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
|