lkml.org 
[lkml]   [2016]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 136/137] [media] usbvision: fix crash on detecting device with invalid configuration
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Vladis Dronov <vdronov@redhat.com>

    commit fa52bd506f274b7619955917abfde355e3d19ffe upstream.

    The usbvision driver crashes when a specially crafted usb device with invalid
    number of interfaces or endpoints is detected. This fix adds checks that the
    device has proper configuration expected by the driver.

    Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
    Signed-off-by: Vladis Dronov <vdronov@redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++-
    1 file changed, 15 insertions(+), 1 deletion(-)

    --- a/drivers/media/usb/usbvision/usbvision-video.c
    +++ b/drivers/media/usb/usbvision/usbvision-video.c
    @@ -1470,9 +1470,23 @@ static int usbvision_probe(struct usb_in

    if (usbvision_device_data[model].interface >= 0)
    interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
    - else
    + else if (ifnum < dev->actconfig->desc.bNumInterfaces)
    interface = &dev->actconfig->interface[ifnum]->altsetting[0];
    + else {
    + dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
    + ifnum, dev->actconfig->desc.bNumInterfaces - 1);
    + ret = -ENODEV;
    + goto err_usb;
    + }
    +
    + if (interface->desc.bNumEndpoints < 2) {
    + dev_err(&intf->dev, "interface %d has %d endpoints, but must"
    + " have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
    + ret = -ENODEV;
    + goto err_usb;
    + }
    endpoint = &interface->endpoint[1].desc;
    +
    if (!usb_endpoint_xfer_isoc(endpoint)) {
    dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
    __func__, ifnum);

    \
     
     \ /
      Last update: 2016-04-18 05:01    [W:4.122 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site