lkml.org 
[lkml]   [2019]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 10/32] ISDN: hfcsusb: checking idx of ep configuration
    Date
    From: Phong Tran <tranmanphong@gmail.com>

    commit f384e62a82ba5d85408405fdd6aeff89354deaa9 upstream.

    The syzbot test with random endpoint address which made the idx is
    overflow in the table of endpoint configuations.

    this adds the checking for fixing the error report from
    syzbot

    KASAN: stack-out-of-bounds Read in hfcsusb_probe [1]
    The patch tested by syzbot [2]

    Reported-by: syzbot+8750abbc3a46ef47d509@syzkaller.appspotmail.com

    [1]:
    https://syzkaller.appspot.com/bug?id=30a04378dac680c5d521304a00a86156bb913522
    [2]:
    https://groups.google.com/d/msg/syzkaller-bugs/_6HBdge8F3E/OJn7wVNpBAAJ

    Signed-off-by: Phong Tran <tranmanphong@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/isdn/hardware/mISDN/hfcsusb.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/isdn/hardware/mISDN/hfcsusb.c
    +++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
    @@ -1967,6 +1967,9 @@ hfcsusb_probe(struct usb_interface *intf

    /* get endpoint base */
    idx = ((ep_addr & 0x7f) - 1) * 2;
    + if (idx > 15)
    + return -EIO;
    +
    if (ep_addr & 0x80)
    idx++;
    attr = ep->desc.bmAttributes;

    \
     
     \ /
      Last update: 2019-08-02 12:09    [W:4.023 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site