From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Masakazu Mokuno <masakazu.mokuno@gmail.com>
Subject: [PATCH 4.14 73/75] USB: core: Add type-specific length check of BOS descriptors
Date: Thu, 7 Dec 2017 14:08:35 +0100 [thread overview]
Message-ID: <20171207130821.764945123@linuxfoundation.org> (raw)
In-Reply-To: <20171207130818.742746317@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masakazu Mokuno <masakazu.mokuno@gmail.com>
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream.
As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.
This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.
Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/config.c | 28 ++++++++++++++++++++++++----
include/uapi/linux/usb/ch9.h | 3 +++
2 files changed, 27 insertions(+), 4 deletions(-)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -905,14 +905,25 @@ void usb_release_bos_descriptor(struct u
}
}
+static const __u8 bos_desc_len[256] = {
+ [USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE,
+ [USB_CAP_TYPE_EXT] = USB_DT_USB_EXT_CAP_SIZE,
+ [USB_SS_CAP_TYPE] = USB_DT_USB_SS_CAP_SIZE,
+ [USB_SSP_CAP_TYPE] = USB_DT_USB_SSP_CAP_SIZE(1),
+ [CONTAINER_ID_TYPE] = USB_DT_USB_SS_CONTN_ID_SIZE,
+ [USB_PTM_CAP_TYPE] = USB_DT_USB_PTM_ID_SIZE,
+};
+
/* Get BOS descriptor set */
int usb_get_bos_descriptor(struct usb_device *dev)
{
struct device *ddev = &dev->dev;
struct usb_bos_descriptor *bos;
struct usb_dev_cap_header *cap;
+ struct usb_ssp_cap_descriptor *ssp_cap;
unsigned char *buffer;
- int length, total_len, num, i;
+ int length, total_len, num, i, ssac;
+ __u8 cap_type;
int ret;
bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL);
@@ -965,7 +976,13 @@ int usb_get_bos_descriptor(struct usb_de
dev->bos->desc->bNumDeviceCaps = i;
break;
}
+ cap_type = cap->bDevCapabilityType;
length = cap->bLength;
+ if (bos_desc_len[cap_type] && length < bos_desc_len[cap_type]) {
+ dev->bos->desc->bNumDeviceCaps = i;
+ break;
+ }
+
total_len -= length;
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
@@ -973,7 +990,7 @@ int usb_get_bos_descriptor(struct usb_de
continue;
}
- switch (cap->bDevCapabilityType) {
+ switch (cap_type) {
case USB_CAP_TYPE_WIRELESS_USB:
/* Wireless USB cap descriptor is handled by wusb */
break;
@@ -986,8 +1003,11 @@ int usb_get_bos_descriptor(struct usb_de
(struct usb_ss_cap_descriptor *)buffer;
break;
case USB_SSP_CAP_TYPE:
- dev->bos->ssp_cap =
- (struct usb_ssp_cap_descriptor *)buffer;
+ ssp_cap = (struct usb_ssp_cap_descriptor *)buffer;
+ ssac = (le32_to_cpu(ssp_cap->bmAttributes) &
+ USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1;
+ if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac))
+ dev->bos->ssp_cap = ssp_cap;
break;
case CONTAINER_ID_TYPE:
dev->bos->ss_id =
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -876,6 +876,8 @@ struct usb_wireless_cap_descriptor { /*
__u8 bReserved;
} __attribute__((packed));
+#define USB_DT_USB_WIRELESS_CAP_SIZE 11
+
/* USB 2.0 Extension descriptor */
#define USB_CAP_TYPE_EXT 2
@@ -1068,6 +1070,7 @@ struct usb_ptm_cap_descriptor {
__u8 bDevCapabilityType;
} __attribute__((packed));
+#define USB_DT_USB_PTM_ID_SIZE 3
/*
* The size of the descriptor for the Sublink Speed Attribute Count
* (SSAC) specified in bmAttributes[4:0].
next prev parent reply other threads:[~2017-12-07 13:15 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-07 13:07 [PATCH 4.14 00/75] 4.14.5-stable review Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 01/75] drm/fsl-dcu: avoid disabling pixel clock twice on suspend Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 02/75] drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 04/75] s390/runtime instrumentation: simplify task exit handling Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 05/75] usbip: fix usbip attach to find a port that matches the requested speed Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 06/75] usbip: Fix USB device hang due to wrong enabling of scatter-gather Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 07/75] uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 08/75] usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 09/75] serial: 8250_pci: Add Amazon PCI serial device ID Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 10/75] ANDROID: binder: fix transaction leak Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 11/75] USB: serial: option: add Quectel BG96 id Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 12/75] USB: serial: usb_debug: add new USB device id Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 13/75] serial: 8250_early: Only set divisor if valid clk & baud Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 14/75] MIPS: Add custom serial.h with BASE_BAUD override for generic kernel Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 15/75] ima: fix hash algorithm initialization Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 16/75] s390: vfio-ccw: Do not attempt to free no-op, test and tic cda Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 17/75] PM / Domains: Fix genpd to deal with drivers returning 1 from ->prepare() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 18/75] s390/pci: do not require AIS facility Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 19/75] selftests/x86/ldt_get: Add a few additional tests for limits Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 20/75] selftests/x86/ldt_gdt: Robustify against set_thread_area() and LAR oddities Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 21/75] staging: greybus: loopback: Fix iteration count on async path Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 22/75] m68k: fix ColdFire node shift size calculation Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 23/75] serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 24/75] staging: rtl8822be: fix wrong dma unmap len Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 25/75] staging: rtl8188eu: avoid a null dereference on pmlmepriv Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 26/75] spi: sh-msiof: Fix DMA transfer size check Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 27/75] spi: spi-axi: fix potential use-after-free after deregistration Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 28/75] mmc: tmio: check mmc_regulator_get_supply return value Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 29/75] mmc: sdhci-msm: fix issue with power irq Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 30/75] hwmon: (pmbus/core) Prevent unintentional setting of page to 0xFF Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 31/75] perf/core: Fix __perf_read_group_add() locking Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 32/75] usb: dwc2: Fix UDC state tracking Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 33/75] usb: dwc2: Error out of dwc2_hsotg_ep_disable() if were in host mode Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 34/75] usb: phy: tahvo: fix error handling in tahvo_usb_probe() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 35/75] PCI: dra7xx: Create functional dependency between PCIe and PHY Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 36/75] x86/intel_rdt: Initialize bitmask of shareable resource if CDP enabled Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 37/75] x86/intel_rdt: Fix potential deadlock during resctrl mount Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 38/75] serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 39/75] kprobes: Use synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 40/75] x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 41/75] clocksource/drivers/arm_arch_timer: Validate CNTFRQ after enabling frame Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 42/75] dt-bindings: timer: renesas, cmt: Fix SoC-specific compatible values Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 43/75] EDAC, sb_edac: Fix missing break in switch Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 44/75] usb: mtu3: fix error return code in ssusb_gadget_init() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 45/75] staging: fsl-dpaa2/eth: Account for Rx FD buffers on error path Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 46/75] staging: rtl8822be: Keep array subscript no lower than zero Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 47/75] ARM: cpuidle: Correct driver unregistration if init fails Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 48/75] usb: xhci: Return error when host is dead in xhci_disable_slot() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 49/75] sysrq : fix Show Regs call trace on ARM Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 50/75] serial: sh-sci: suppress warning for ports without dma channels Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 51/75] usbip: tools: Install all headers needed for libusbip development Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 53/75] staging: fsl-mc/dpio: Fix incorrect comparison Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 54/75] perf test attr: Fix ignored test case result Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 55/75] perf test attr: Fix python error on empty result Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 56/75] kprobes/x86: Disable preemption in ftrace-based jprobes Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 57/75] locking/refcounts, x86/asm: Use unique .text section for refcount exceptions Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 58/75] s390/ptrace: fix guarded storage regset handling Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 60/75] perf tools: Fix leaking rec_argv in error cases Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 61/75] mm, x86/mm: Fix performance regression in get_user_pages_fast() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 63/75] iio: multiplexer: add NULL check on devm_kzalloc() and devm_kmemdup() return values Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 64/75] locking/refcounts, x86/asm: Enable CONFIG_ARCH_HAS_REFCOUNT Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 65/75] powerpc/jprobes: Disable preemption when triggered through ftrace Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 66/75] powerpc/kprobes: Disable preemption before invoking probe handler for optprobes Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 67/75] dma-buf/sw_sync: force signal all unsignaled fences on dying timeline Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 68/75] staging: ccree: fix leak of import() after init() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 69/75] usb: hub: Cycle HUB power when initialization fails Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 70/75] USB: ulpi: fix bus-node lookup Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 71/75] xhci: Dont show incorrect WARN message about events for empty rings Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 72/75] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Greg Kroah-Hartman
2017-12-07 13:08 ` Greg Kroah-Hartman [this message]
2017-12-07 13:08 ` [PATCH 4.14 74/75] USB: usbfs: Filter flags passed in from user space Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 75/75] usb: host: fix incorrect updating of offset Greg Kroah-Hartman
2017-12-07 20:55 ` [PATCH 4.14 00/75] 4.14.5-stable review Guenter Roeck
2017-12-08 10:37 ` Greg Kroah-Hartman
2017-12-08 0:08 ` Shuah Khan
2017-12-08 10:34 ` Greg Kroah-Hartman
2017-12-08 5:35 ` Naresh Kamboju
2017-12-09 3:34 ` Ivan Kozik
2017-12-09 7:45 ` Greg Kroah-Hartman
2017-12-09 7:56 ` Ivan Kozik
2017-12-09 17:13 ` Greg Kroah-Hartman
2017-12-09 17:32 ` Thomas Backlund
2017-12-10 12:36 ` Greg Kroah-Hartman
2017-12-09 18:39 ` Ivan Kozik
[not found] ` <5a29b63a.13bbdf0a.b5a04.7588@mx.google.com>
[not found] ` <7hk1xxkmw9.fsf@baylibre.com>
2017-12-09 16:59 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171207130821.764945123@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=masakazu.mokuno@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).