linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Josh Boyer <jwboyer@fedoraproject.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>,
	linux-input@vger.kernel.org, linux-usb@vger.kernel.org,
	linux-kernel@vger.kernel.org, stable <stable@vger.kernel.org>
Subject: Re: [PATCH] USB: input: powermate: fix oops with malicious USB descriptors
Date: Mon, 14 Mar 2016 09:15:48 -0700	[thread overview]
Message-ID: <20160314161548.GA2585@kroah.com> (raw)
In-Reply-To: <1457964773-29512-1-git-send-email-jwboyer@fedoraproject.org>

On Mon, Mar 14, 2016 at 10:12:53AM -0400, Josh Boyer wrote:
> The powermate driver expects at least one valid USB endpoint in its
> probe function.  If given malicious descriptors that specify 0 for
> the number of endpoints, it will crash.  Validate the number of
> endpoints on the interface before using them.
> 
> The full report for this issue can be found here:
> http://seclists.org/bugtraq/2016/Mar/85
> 
> Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
> Cc: stable <stable@vger.kernel.org>
> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
> ---
>  drivers/input/misc/powermate.c | 3 +++
>  1 file changed, 3 insertions(+)

I'll queue these up after 4.6-rc1 is out as the merge window is closed
right now, but we might want to think about a better way to handle this
type of thing in the USB core.  A way to keep from having to add checks
like this for every single driver, when the driver shouldn't even really
have their probe function called unless their expected endpoints are
going to be there.

I'll think about that over the next few weeks...

thanks,

greg k-h

  reply	other threads:[~2016-03-14 16:15 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-03-14 14:12 [PATCH] USB: input: powermate: fix oops with malicious USB descriptors Josh Boyer
2016-03-14 16:15 ` Greg Kroah-Hartman [this message]
2016-03-14 16:33   ` Dmitry Torokhov
2016-03-14 16:46   ` Josh Boyer
2016-03-14 16:48     ` Dmitry Torokhov
2016-03-14 17:07     ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160314161548.GA2585@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=dmitry.torokhov@gmail.com \
    --cc=jwboyer@fedoraproject.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).