Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp838895imu; Tue, 11 Dec 2018 08:19:59 -0800 (PST) X-Google-Smtp-Source: AFSGD/UDXKYPctE/YhOB1VyZWoAUyIClrS70GaF2vWaWZ69zTe+bTG7JI8adz2xFIA92TiqsrTEm X-Received: by 2002:a62:8d4f:: with SMTP id z76mr17469171pfd.2.1544545199423; Tue, 11 Dec 2018 08:19:59 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1544545199; cv=none; d=google.com; s=arc-20160816; b=vHwfOueYTWaHqwk9w0HBnX+j1ssialZur8n+Y661QdKF1Q50afM4Y/lm3iGmZNyCgg 3G2pI7cy5zTe2Ytcatg1aIV2MY06XouWB1TF+a32tBdOKSSu8TZbyuy5Y9rYStLufTeH kih3hfxJ6YATE3UzlGQ/1AR5zS9isp4a4+cqHv93hzh+9K2m6Sn7valsvrCvjyX1fCyy mo0rgF7vNxBgI8f8ySpQTTmoT+7ByAqSeuZGowvAQ/qLyOklbKyHtHUhvJzTf/nFMvFO 0ixE1/NDAGlw1XTfWkQr7tVnloxpjEPQlkyN13nSjAqdl57kGRwT6YwaVPgId8DniHg+ Sebw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=y43ud3GC68SZxaLPYOQOIKv2Z8DqzafjQUEdU0cYjOI=; b=Y7nYvSVILA2h5WmiMSRBBycrqtY8emRnehEBVJ7UimyoC5SwJm4yRzQ1Vk0t/eq+SW Iw00gHafXuQBc4b5B056rmCa+Zs3hgImnJ5SPk15CUMS+u0OxrgabJEBTBZcif7Ya9Ld ERnL4aXkKfLM8pgLBGIxi/Txi/ql2UssoNm+uURdwIQrKM5qmqR5Vdd39PI2DnatHlwc eEvJOSVtR7zCrGG81c8LhW7qQjDF9vvSe/wEuXQnjrHyM9xJW1Gz8i9naxHGVKs6vaRJ vy7gmuH+U13HGRdTElHVGKLnGxYseDSNqNeBUD6M/pGcfUZdrl2OcXWsLJZtKC/edA3U vvdQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=K0N2bu+n; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b36si13365961pla.354.2018.12.11.08.19.44; Tue, 11 Dec 2018 08:19:59 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=K0N2bu+n; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728605AbeLKPrj (ORCPT + 99 others); Tue, 11 Dec 2018 10:47:39 -0500 Received: from mail.kernel.org ([198.145.29.99]:36080 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727969AbeLKPrh (ORCPT ); Tue, 11 Dec 2018 10:47:37 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0623C20989; Tue, 11 Dec 2018 15:47:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544543256; bh=0oI8jiRAo1J3dHZT2oWFU/RLwIMb7eNd2Wd2DPLW1JI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K0N2bu+nZ05wCQVTod1lUF/ro9cpKcAbeAmQQgzkwNZ3PMVxZnqS0CTeH7bZXk7TU 9mHp8vPr6vGvdk9oGyIFLFPDq91tDabpAudzw7QRmwUu+C5Khd8LgIt5DZF9Y4nxwp lCNevyP4PrVlCIJbrOILTrpEEPA8ysb3scJgTU2g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hui Peng , Mathias Payer , Linus Torvalds , stable Subject: [PATCH 4.4 72/91] USB: check usb_get_extra_descriptor for proper size Date: Tue, 11 Dec 2018 16:41:31 +0100 Message-Id: <20181211151612.247415249@linuxfoundation.org> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20181211151606.026852373@linuxfoundation.org> References: <20181211151606.026852373@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mathias Payer commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream. When reading an extra descriptor, we need to properly check the minimum and maximum size allowed, to prevent from invalid data being sent by a device. Reported-by: Hui Peng Reported-by: Mathias Payer Co-developed-by: Linus Torvalds Signed-off-by: Hui Peng Signed-off-by: Mathias Payer Signed-off-by: Linus Torvalds Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hub.c | 2 +- drivers/usb/core/usb.c | 6 +++--- drivers/usb/host/hwa-hc.c | 2 +- include/linux/usb.h | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -2211,7 +2211,7 @@ static int usb_enumerate_device_otg(stru /* descriptor may appear anywhere in config */ err = __usb_get_extra_descriptor(udev->rawdescriptors[0], le16_to_cpu(udev->config[0].desc.wTotalLength), - USB_DT_OTG, (void **) &desc); + USB_DT_OTG, (void **) &desc, sizeof(*desc)); if (err || !(desc->bmAttributes & USB_OTG_HNP)) return 0; --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -678,14 +678,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_ */ int __usb_get_extra_descriptor(char *buffer, unsigned size, - unsigned char type, void **ptr) + unsigned char type, void **ptr, size_t minsize) { struct usb_descriptor_header *header; while (size >= sizeof(struct usb_descriptor_header)) { header = (struct usb_descriptor_header *)buffer; - if (header->bLength < 2) { + if (header->bLength < 2 || header->bLength > size) { printk(KERN_ERR "%s: bogus descriptor, type %d length %d\n", usbcore_name, @@ -694,7 +694,7 @@ int __usb_get_extra_descriptor(char *buf return -1; } - if (header->bDescriptorType == type) { + if (header->bDescriptorType == type && header->bLength >= minsize) { *ptr = header; return 0; } --- a/drivers/usb/host/hwa-hc.c +++ b/drivers/usb/host/hwa-hc.c @@ -654,7 +654,7 @@ static int hwahc_security_create(struct top = itr + itr_size; result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index], le16_to_cpu(usb_dev->actconfig->desc.wTotalLength), - USB_DT_SECURITY, (void **) &secd); + USB_DT_SECURITY, (void **) &secd, sizeof(*secd)); if (result == -1) { dev_warn(dev, "BUG? WUSB host has no security descriptors\n"); return 0; --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -334,11 +334,11 @@ struct usb_host_bos { }; int __usb_get_extra_descriptor(char *buffer, unsigned size, - unsigned char type, void **ptr); + unsigned char type, void **ptr, size_t min); #define usb_get_extra_descriptor(ifpoint, type, ptr) \ __usb_get_extra_descriptor((ifpoint)->extra, \ (ifpoint)->extralen, \ - type, (void **)ptr) + type, (void **)ptr, sizeof(**(ptr))) /* ----------------------------------------------------------------------- */