Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 13 May 2019 22:48:51 +0200
From:   Greg KH <greg@kroah.com>
To:     Alan Stern <stern@rowland.harvard.edu>
Cc:     andreyknvl@google.com, gustavo@embeddedor.com,
        Kernel development list <linux-kernel@vger.kernel.org>,
        USB list <linux-usb@vger.kernel.org>, suwan.kim027@gmail.com,
        syzkaller-bugs@googlegroups.com
Subject: Re: [PATCH] USB: Fix slab-out-of-bounds write in
 usb_get_bos_descriptor
Message-ID: <20190513204851.GA20475@kroah.com>
References: <00000000000061c7cd0588c6933c@google.com>
 <Pine.LNX.4.44L0.1905131313100.1478-100000@iolanthe.rowland.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.44L0.1905131313100.1478-100000@iolanthe.rowland.org>
User-Agent: Mutt/1.11.4 (2019-03-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, May 13, 2019 at 01:14:29PM -0400, Alan Stern wrote:
> The syzkaller USB fuzzer found a slab-out-of-bounds write bug in the
> USB core, caused by a failure to check the actual size of a BOS
> descriptor.  This patch adds a check to make sure the descriptor is at
> least as large as it is supposed to be, so that the code doesn't
> inadvertently access memory beyond the end of the allocated region
> when assigning to dev->bos->desc->bNumDeviceCaps later on.
> 
> Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
> Reported-and-tested-by: syzbot+71f1e64501a309fcc012@syzkaller.appspotmail.com
> CC: <stable@vger.kernel.org>
> 
> ---
> 
> 
> [as1898]
> 
> 
>  drivers/usb/core/config.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> Index: usb-devel/drivers/usb/core/config.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/core/config.c
> +++ usb-devel/drivers/usb/core/config.c
> @@ -932,8 +932,8 @@ int usb_get_bos_descriptor(struct usb_de
>  
>  	/* Get BOS descriptor */
>  	ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE);
> -	if (ret < USB_DT_BOS_SIZE) {
> -		dev_err(ddev, "unable to get BOS descriptor\n");
> +	if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) {
> +		dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n");

Nice fix, I thought we had found all of these the last time we fuzzed
this area :)

I'll queue this up once 5.2-rc1 is out, thanks.

greg k-h