Received: by 10.223.185.116 with SMTP id b49csp6327277wrg; Wed, 28 Feb 2018 07:38:00 -0800 (PST) X-Google-Smtp-Source: AG47ELvjdVgQbZuN0gowBxxeqc9Xw+IAz9geshjJA0OFV2rHDS9TnrHN8JXqIS+wUH1JbjTe6BV4 X-Received: by 2002:a17:902:8a8d:: with SMTP id p13-v6mr15059266plo.144.1519832280471; Wed, 28 Feb 2018 07:38:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519832280; cv=none; d=google.com; s=arc-20160816; b=AlkObudA4ODm51PoYMDPZMLC2+Vl5S9T5GugIMr/WiP2SBT1pFrQKDGgUFCCMfMM2K i2Ogcqf+3UtY8TpPF5nCwGOsT5b1Ws6nhsZi1pukEQPXRQiYMkPmpy75JNDysKIx9qn5 NAyqj6dXjy9CS9T53Em+Ce1VFnlynKqTRIRlaspeUwzoKN1K4xxLI2gOD6LkpK+8yLqJ /TGQdO7UAw1RAr8Mrei8G5YkHA6YcS41DeBkkn229Mhet/WlqOrXErrt1OTva0SwKS7i 0dZXzdJyb78p0fXFVLu3sTfgPU6/xl1tGP6pK16v213R04OCaMamHx/RNbVG9QYgOQ++ IUaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=o0q9Kl1uJq3UIThopK6aeHuYKn0W+STCrgEitXjNw9A=; b=kAVx9LYEr01y8TSNhrPQn3LHw1AGZiSjCaWHzD5W7RRxMbe4rr/22ckGTILWbNXEym klydIENo3MyOq8PZs4qgTMB5AorFL6pB+aba4jSj/7Hf3+0GLQXwbJ3wftQ5hTWL4I9d wc59IWs2Ms9Lf4vJBd3vRxI6T3hcPR8omhtJOJ4FP3R9SLM7YHFQsyzjGUQJN3echSD/ YsVYYzzAd203vuUk0HoTeu8BAPXvXpRVfhHjhY1jI9JnGLNOKy7eiEPUKKZldMZNrjDK uSY+gmkWflldCGK1xzYzo6dYjhOIAI0x7FUQVeMM9uJwQeBDOOCgd8MquHbdgcKn186a /5Lw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bg2-v6si1418832plb.662.2018.02.28.07.37.45; Wed, 28 Feb 2018 07:38:00 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933100AbeB1Pen (ORCPT + 99 others); Wed, 28 Feb 2018 10:34:43 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:33327 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752845AbeB1PWh (ORCPT ); Wed, 28 Feb 2018 10:22:37 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Ye-0006Xi-AH; Wed, 28 Feb 2018 15:22:16 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yd-0008Nn-Fk; Wed, 28 Feb 2018 15:22:15 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Andrey Konovalov" , "Greg Kroah-Hartman" , "Alan Stern" , "Oliver Neukum" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 021/254] USB: usbfs: Filter flags passed in from user space In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Neukum commit 446f666da9f019ce2ffd03800995487e79a91462 upstream. USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints. Improve sanity checking. Reported-by: Andrey Konovalov Signed-off-by: Oliver Neukum Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- drivers/usb/core/devio.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -1295,14 +1295,18 @@ static int proc_do_submiturb(struct usb_ int number_of_packets = 0; unsigned int stream_id = 0; void *buf; - - if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP | - USBDEVFS_URB_SHORT_NOT_OK | + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | USBDEVFS_URB_BULK_CONTINUATION | USBDEVFS_URB_NO_FSBR | USBDEVFS_URB_ZERO_PACKET | - USBDEVFS_URB_NO_INTERRUPT)) - return -EINVAL; + USBDEVFS_URB_NO_INTERRUPT; + /* USBDEVFS_URB_ISO_ASAP is a special case */ + if (uurb->type == USBDEVFS_URB_TYPE_ISO) + mask |= USBDEVFS_URB_ISO_ASAP; + + if (uurb->flags & ~mask) + return -EINVAL; + if (uurb->buffer_length > 0 && !uurb->buffer) return -EINVAL; if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&