USB: core: prevent malicious bNumInterfaces overflow

From: Alan Stern <stern@rowland.harvard.edu>
To: Greg KH <greg@kroah.com>
Cc: Peter Chen <hzpeterchen@gmail.com>,
	Andrey Konovalov <andreyknvl@google.com>,
	USB list <linux-usb@vger.kernel.org>
Subject: USB: core: prevent malicious bNumInterfaces overflow
Date: Wed, 13 Dec 2017 10:30:50 -0500 (EST)	[thread overview]
Message-ID: <Pine.LNX.4.44L0.1712131029010.1351-100000@iolanthe.rowland.org> (raw)

On Wed, 13 Dec 2017, Greg KH wrote:

> > > --- usb-4.x.orig/drivers/usb/core/config.c
> > > +++ usb-4.x/drivers/usb/core/config.c
> > > @@ -555,6 +555,9 @@ static int usb_parse_configuration(struc
> > >  	unsigned iad_num = 0;
> > >  
> > >  	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
> > > +	nintf = nintf_orig = config->desc.bNumInterfaces;
> > > +	config->desc.bNumInterfaces = 0;	// Adjusted later
> > > +
> > 
> > The comment format?
> 
> Is fine, I've given up that fight :)

In fact, Linus posted an email sometime in the last few weeks, in which 
he said that he had changed his mind about // comments.  He called it 
the one thing that C++ got right!

Also, checkpatch didn't complain.

Alan Stern
---
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html