lkml.org 
[lkml]   [2020]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 41/70] usb: core: fix slab-out-of-bounds Read in read_descriptors
    Date
    From: Zeng Tao <prime.zeng@hisilicon.com>

    commit a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 upstream.

    The USB device descriptor may get changed between two consecutive
    enumerations on the same device for some reason, such as DFU or
    malicius device.
    In that case, we may access the changing descriptor if we don't take
    the device lock here.

    The issue is reported:
    https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9

    Cc: stable <stable@vger.kernel.org>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
    Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute")
    Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
    Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/core/sysfs.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/drivers/usb/core/sysfs.c
    +++ b/drivers/usb/core/sysfs.c
    @@ -848,7 +848,11 @@ read_descriptors(struct file *filp, stru
    size_t srclen, n;
    int cfgno;
    void *src;
    + int retval;

    + retval = usb_lock_device_interruptible(udev);
    + if (retval < 0)
    + return -EINTR;
    /* The binary attribute begins with the device descriptor.
    * Following that are the raw descriptor entries for all the
    * configurations (config plus subsidiary descriptors).
    @@ -873,6 +877,7 @@ read_descriptors(struct file *filp, stru
    off -= srclen;
    }
    }
    + usb_unlock_device(udev);
    return count - nleft;
    }


    \
     
     \ /
      Last update: 2020-09-21 19:06    [W:4.218 / U:0.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site