mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-09-21 11:53:01 +00:00
USB: fix out-of-bounds in usb_set_configuration
Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes: It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount. And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller... Change-Id: Ibe721523465bd15fc746bdfbf3e7aec908e688bb Git-commit: bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb Git-repo: https://github.com/torvalds/linux/commit Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>
This commit is contained in:
parent
a32ae56e01
commit
5586545b94
|
@ -513,15 +513,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
|
|||
|
||||
} else if (header->bDescriptorType ==
|
||||
USB_DT_INTERFACE_ASSOCIATION) {
|
||||
struct usb_interface_assoc_descriptor *d;
|
||||
|
||||
d = (struct usb_interface_assoc_descriptor *)header;
|
||||
if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
|
||||
dev_warn(ddev,
|
||||
"config %d has an invalid interface association descriptor of length %d, skipping\n",
|
||||
cfgno, d->bLength);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (iad_num == USB_MAXIADS) {
|
||||
dev_warn(ddev, "found more Interface "
|
||||
"Association Descriptors "
|
||||
"than allocated for in "
|
||||
"configuration %d\n", cfgno);
|
||||
} else {
|
||||
config->intf_assoc[iad_num] =
|
||||
(struct usb_interface_assoc_descriptor
|
||||
*)header;
|
||||
config->intf_assoc[iad_num] = d;
|
||||
iad_num++;
|
||||
}
|
||||
|
||||
|
|
|
@ -720,6 +720,7 @@ struct usb_interface_assoc_descriptor {
|
|||
__u8 iFunction;
|
||||
} __attribute__ ((packed));
|
||||
|
||||
#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8
|
||||
|
||||
/*-------------------------------------------------------------------------*/
|
||||
|
||||
|
|
Loading…
Reference in a new issue