lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 088/147] USB: fix out-of-bounds in usb_set_configuration
    3.2.95-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.

    Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
    association descriptor. He writes:
    It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
    descriptor. It's only checked that the size is >= 2 in
    usb_parse_configuration(), so find_iad() might do out-of-bounds access
    to intf_assoc->bInterfaceCount.

    And he's right, we don't check for crazy descriptors of this type very well, so
    resolve this problem. Yet another issue found by syzkaller...

    Reported-by: Andrey Konovalov <andreyknvl@google.com>
    Tested-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/core/config.c | 14 +++++++++++---
    include/linux/usb/ch9.h | 1 +
    2 files changed, 12 insertions(+), 3 deletions(-)

    --- a/drivers/usb/core/config.c
    +++ b/drivers/usb/core/config.c
    @@ -609,15 +609,23 @@ static int usb_parse_configuration(struc

    } else if (header->bDescriptorType ==
    USB_DT_INTERFACE_ASSOCIATION) {
    + struct usb_interface_assoc_descriptor *d;
    +
    + d = (struct usb_interface_assoc_descriptor *)header;
    + if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
    + dev_warn(ddev,
    + "config %d has an invalid interface association descriptor of length %d, skipping\n",
    + cfgno, d->bLength);
    + continue;
    + }
    +
    if (iad_num == USB_MAXIADS) {
    dev_warn(ddev, "found more Interface "
    "Association Descriptors "
    "than allocated for in "
    "configuration %d\n", cfgno);
    } else {
    - config->intf_assoc[iad_num] =
    - (struct usb_interface_assoc_descriptor
    - *)header;
    + config->intf_assoc[iad_num] = d;
    iad_num++;
    }

    --- a/include/linux/usb/ch9.h
    +++ b/include/linux/usb/ch9.h
    @@ -686,6 +686,7 @@ struct usb_interface_assoc_descriptor {
    __u8 iFunction;
    } __attribute__ ((packed));

    +#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8

    /*-------------------------------------------------------------------------*/

    \
     
     \ /
      Last update: 2017-11-08 20:57    [W:4.096 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site