Patch "USB: fix out-of-bounds in usb_set_configuration" has been added to the 4.9-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    USB: fix out-of-bounds in usb_set_configuration

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-fix-out-of-bounds-in-usb_set_configuration.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Tue, 19 Sep 2017 15:07:17 +0200
Subject: USB: fix out-of-bounds in usb_set_configuration

From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.

Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor.  He writes:
	It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
	descriptor. It's only checked that the size is >= 2 in
	usb_parse_configuration(), so find_iad() might do out-of-bounds access
	to intf_assoc->bInterfaceCount.

And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem.  Yet another issue found by syzkaller...

Reported-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Tested-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

---
 drivers/usb/core/config.c    |   14 +++++++++++---
 include/uapi/linux/usb/ch9.h |    1 +
 2 files changed, 12 insertions(+), 3 deletions(-)

--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -638,15 +638,23 @@ static int usb_parse_configuration(struc
 
 		} else if (header->bDescriptorType ==
 				USB_DT_INTERFACE_ASSOCIATION) {
+			struct usb_interface_assoc_descriptor *d;
+
+			d = (struct usb_interface_assoc_descriptor *)header;
+			if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+				dev_warn(ddev,
+					 "config %d has an invalid interface association descriptor of length %d, skipping\n",
+					 cfgno, d->bLength);
+				continue;
+			}
+
 			if (iad_num == USB_MAXIADS) {
 				dev_warn(ddev, "found more Interface "
 					       "Association Descriptors "
 					       "than allocated for in "
 					       "configuration %d\n", cfgno);
 			} else {
-				config->intf_assoc[iad_num] =
-					(struct usb_interface_assoc_descriptor
-					*)header;
+				config->intf_assoc[iad_num] = d;
 				iad_num++;
 			}
 
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -759,6 +759,7 @@ struct usb_interface_assoc_descriptor {
 	__u8  iFunction;
 } __attribute__ ((packed));
 
+#define USB_DT_INTERFACE_ASSOCIATION_SIZE	8
 
 /*-------------------------------------------------------------------------*/
 


Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are

queue-4.9/usb-fix-out-of-bounds-in-usb_set_configuration.patch
queue-4.9/usb-storage-fix-bogus-hardware-error-messages-for-ata-pass-thru-devices.patch
queue-4.9/usb-cdc-wdm-ignore-epipe-from-getencapsulatedresponse.patch
queue-4.9/xhci-fix-finding-correct-bus_state-structure-for-usb-3.1-hosts.patch
queue-4.9/revert-xhci-limit-usb2-port-wake-support-for-amd-promontory-hosts.patch
queue-4.9/usb-uas-fix-bug-in-handling-of-alternate-settings.patch
queue-4.9/alsa-usb-audio-check-out-of-bounds-access-by-corrupted-buffer-descriptor.patch
queue-4.9/usb-increase-quirk-delay-for-usb-devices.patch
queue-4.9/usb-gadget-udc-renesas_usb3-fix-return-value-of-usb3_write_pipe.patch
queue-4.9/xhci-set-missing-superspeedplus-link-protocol-bit-in-roothub-descriptor.patch
queue-4.9/usb-gadget-udc-renesas_usb3-fix-pn_rammap.pn_mpkt-value.patch
queue-4.9/iio-adc-twl4030-fix-an-error-handling-path-in-twl4030_madc_probe.patch
queue-4.9/usb-dummy-hcd-fix-infinite-loop-resubmission-bug.patch
queue-4.9/usb-pci-quirks.c-corrected-timeout-values-used-in-handshake.patch
queue-4.9/usb-storage-unusual_devs-entry-to-fix-write-access-regression-for-seagate-external-drives.patch
queue-4.9/usb-core-harden-cdc_parse_cdc_header.patch
queue-4.9/usb-renesas_usbhs-fix-usbhsf_fifo_clear-for-rx-direction.patch
queue-4.9/usb-gadget-udc-atmel-set-vbus-irqflags-explicitly.patch
queue-4.9/iio-adc-twl4030-disable-the-vusb3v1-rugulator-in-the-error-handling-path-of-twl4030_madc_probe.patch
queue-4.9/usb-gadget-udc-renesas_usb3-fix-for-no-data-control-transfer.patch
queue-4.9/usb-renesas_usbhs-fix-the-bclr-setting-condition-for-non-dcp-pipe.patch
queue-4.9/usb-gadgetfs-fix-copy_to_user-while-holding-spinlock.patch
queue-4.9/usb-devio-don-t-corrupt-user-memory.patch
queue-4.9/usb-g_mass_storage-fix-deadlock-when-driver-is-unbound.patch
queue-4.9/usb-gadgetfs-fix-crash-caused-by-inadequate-synchronization.patch
queue-4.9/usb-dummy-hcd-fix-connection-failures-wrong-speed.patch
queue-4.9/usb-dummy-hcd-fix-erroneous-synchronization-change.patch
queue-4.9/xhci-fix-sleeping-with-spin_lock_irq-held-in-asmedia-1042a-workaround.patch



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]