lkml.org 
[lkml]   [2017]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 108/109] USB: usbfs: Filter flags passed in from user space
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Oliver Neukum <oneukum@suse.com>

    commit 446f666da9f019ce2ffd03800995487e79a91462 upstream.

    USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
    Improve sanity checking.

    Reported-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/core/devio.c | 14 +++++++++-----
    1 file changed, 9 insertions(+), 5 deletions(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -1454,14 +1454,18 @@ static int proc_do_submiturb(struct usb_
    int number_of_packets = 0;
    unsigned int stream_id = 0;
    void *buf;
    -
    - if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
    - USBDEVFS_URB_SHORT_NOT_OK |
    + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK |
    USBDEVFS_URB_BULK_CONTINUATION |
    USBDEVFS_URB_NO_FSBR |
    USBDEVFS_URB_ZERO_PACKET |
    - USBDEVFS_URB_NO_INTERRUPT))
    - return -EINVAL;
    + USBDEVFS_URB_NO_INTERRUPT;
    + /* USBDEVFS_URB_ISO_ASAP is a special case */
    + if (uurb->type == USBDEVFS_URB_TYPE_ISO)
    + mask |= USBDEVFS_URB_ISO_ASAP;
    +
    + if (uurb->flags & ~mask)
    + return -EINVAL;
    +
    if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
    return -EINVAL;
    if (uurb->buffer_length > 0 && !uurb->buffer)

    \
     
     \ /
      Last update: 2017-12-07 14:03    [W:2.527 / U:0.556 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site