Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933887AbcDLOZu (ORCPT ); Tue, 12 Apr 2016 10:25:50 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:38908 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933138AbcDLOZq (ORCPT ); Tue, 12 Apr 2016 10:25:46 -0400 Date: Tue, 12 Apr 2016 07:25:45 -0700 From: Greg Kroah-Hartman To: Ben Hutchings Cc: Josh Boyer , stable@vger.kernel.org, Ralf Spenneberg , linux-kernel@vger.kernel.org Subject: Re: [PATCH 4.5 058/238] USB: iowarrior: fix oops with malicious USB descriptors Message-ID: <20160412142545.GG7996@kroah.com> References: <20160410183456.398741366@linuxfoundation.org> <20160410183459.726977519@linuxfoundation.org> <1460425053.25201.94.camel@decadent.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1460425053.25201.94.camel@decadent.org.uk> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1234 Lines: 32 On Tue, Apr 12, 2016 at 02:37:33AM +0100, Ben Hutchings wrote: > On Sun, 2016-04-10 at 11:33 -0700, Greg Kroah-Hartman wrote: > > > 4.5-stable review patch.??If anyone has any objections, please let me know. > > > > ------------------ > > > > From: Josh Boyer > > > > commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream. > > > > The iowarrior driver expects at least one valid endpoint.??If given > > malicious descriptors that specify 0 for the number of endpoints, > > it will crash in the probe function.??Ensure there is at least > > one endpoint on the interface before using it. > [...] > > Which means our imaginary attacker will move on to providing a single > endpoint of the wrong type. ?You've fixed the driver to reject the PoC > descriptor without thinking about what the driver actually requires. > > I don't see the point of applying this to stable; it doesn't provide > any meaningful security benefit. Well, it's one hurdle down, but yes, it needs to be fixed "correctly" Ideally all of these types of issues can be fixed in the USB core, I just need to carve out some time to resolve them, but for now, let's stay in sync with Linus's tree for this patch. thanks, greg k-h