lkml.org 
[lkml]   [2020]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 081/245] staging: gigaset: fix general protection fault on probe
    3.16.83-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit 53f35a39c3860baac1e5ca80bf052751cfb24a99 upstream.

    Fix a general protection fault when accessing the endpoint descriptors
    which could be triggered by a malicious device due to missing sanity
    checks on the number of endpoints.

    Reported-by: syzbot+35b1c403a14f5c89eba7@syzkaller.appspotmail.com
    Fixes: 07dc1f9f2f80 ("[PATCH] isdn4linux: Siemens Gigaset drivers - M105 USB DECT adapter")
    Cc: Hansjoerg Lipp <hjlipp@web.de>
    Cc: Tilman Schmidt <tilman@imap.cc>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20191202085610.12719-2-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.16: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/isdn/gigaset/usb-gigaset.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/drivers/isdn/gigaset/usb-gigaset.c
    +++ b/drivers/isdn/gigaset/usb-gigaset.c
    @@ -693,6 +693,11 @@ static int gigaset_probe(struct usb_inte
    return -ENODEV;
    }

    + if (hostif->desc.bNumEndpoints < 2) {
    + dev_err(&interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    dev_info(&udev->dev, "%s: Device matched ... !\n", __func__);

    /* allocate memory for our device state and initialize it */
    \
     
     \ /
      Last update: 2020-04-24 01:20    [W:4.027 / U:1.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site