Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937556AbdLRRnb (ORCPT ); Mon, 18 Dec 2017 12:43:31 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:36770 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934652AbdLRP6A (ORCPT ); Mon, 18 Dec 2017 10:58:00 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Secunia Research , Shuah Khan Subject: [PATCH 4.9 012/177] usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer Date: Mon, 18 Dec 2017 16:47:15 +0100 Message-Id: <20171218152910.469728229@linuxfoundation.org> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20171218152909.823644066@linuxfoundation.org> References: <20171218152909.823644066@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1196 Lines: 38 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shuah Khan commit be6123df1ea8f01ee2f896a16c2b7be3e4557a5a upstream. stub_send_ret_submit() handles urb with a potential null transfer_buffer, when it replays a packet with potential malicious data that could contain a null buffer. Add a check for the condition when actual_length > 0 and transfer_buffer is null. Reported-by: Secunia Research Signed-off-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman --- drivers/usb/usbip/stub_tx.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/usb/usbip/stub_tx.c +++ b/drivers/usb/usbip/stub_tx.c @@ -181,6 +181,13 @@ static int stub_send_ret_submit(struct s memset(&pdu_header, 0, sizeof(pdu_header)); memset(&msg, 0, sizeof(msg)); + if (urb->actual_length > 0 && !urb->transfer_buffer) { + dev_err(&sdev->udev->dev, + "urb: actual_length %d transfer_buffer null\n", + urb->actual_length); + return -1; + } + if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) iovnum = 2 + urb->number_of_packets; else