This is a note to let you know that I've just added the patch titled
comedi: ni_usb6501: fix NULL-deref in command paths
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
comedi-ni_usb6501-fix-null-deref-in-command-paths.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 907767da8f3a925b060c740e0b5c92ea7dbec440 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@xxxxxxxxxx>
Date: Wed, 27 Oct 2021 11:35:28 +0200
Subject: comedi: ni_usb6501: fix NULL-deref in command paths
From: Johan Hovold <johan@xxxxxxxxxx>
commit 907767da8f3a925b060c740e0b5c92ea7dbec440 upstream.
The driver uses endpoint-sized USB transfer buffers but had no sanity
checks on the sizes. This can lead to zero-size-pointer dereferences or
overflowed transfer buffers in ni6501_port_command() and
ni6501_counter_command() if a (malicious) device has smaller max-packet
sizes than expected (or when doing descriptor fuzz testing).
Add the missing sanity checks to probe().
Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support")
Cc: stable@xxxxxxxxxxxxxxx # 3.18
Cc: Luca Ellero <luca.ellero@xxxxxxxxxxxxxxxx>
Reviewed-by: Ian Abbott <abbotti@xxxxxxxxx>
Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20211027093529.30896-2-johan@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/staging/comedi/drivers/ni_usb6501.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/staging/comedi/drivers/ni_usb6501.c
+++ b/drivers/staging/comedi/drivers/ni_usb6501.c
@@ -153,6 +153,10 @@ static const u8 READ_COUNTER_RESPONSE[]
0x00, 0x00, 0x00, 0x02,
0x00, 0x00, 0x00, 0x00};
+/* Largest supported packets */
+static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
+static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
+
enum commands {
READ_PORT,
WRITE_PORT,
@@ -510,6 +514,12 @@ static int ni6501_find_endpoints(struct
if (!devpriv->ep_rx || !devpriv->ep_tx)
return -ENODEV;
+ if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
+ return -ENODEV;
+
+ if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
+ return -ENODEV;
+
return 0;
}
Patches currently in stable-queue which might be from johan@xxxxxxxxxx are
queue-4.4/comedi-ni_usb6501-fix-null-deref-in-command-paths.patch
queue-4.4/comedi-dt9812-fix-dma-buffers-on-stack.patch
queue-4.4/staging-r8712u-fix-control-message-timeout.patch
queue-4.4/comedi-vmk80xx-fix-bulk-buffer-overflow.patch
queue-4.4/comedi-vmk80xx-fix-transfer-buffer-overflows.patch
queue-4.4/comedi-vmk80xx-fix-bulk-and-interrupt-message-timeouts.patch
queue-4.4/rsi-fix-control-message-timeout.patch
queue-4.4/staging-rtl8192u-fix-control-message-timeouts.patch
queue-4.4/net-hso-register-netdev-later-to-avoid-a-race-condition.patch
