USB: mct_u232: add sanity checking in probe
Subsystems (3)
A message that is not in the archive (sent off-list or not yet received): [email protected]
Johan Hovold
maintainerPATCH 1/3 USB: mct_u232: add sanity checking in probe
From: Oliver Neukum <[email protected]>
An attack using the lack of sanity checking in probe is known. This patch checks for the existence of a second port.
CVE-2016-3136
Signed-off-by Oliver Neukum <[email protected]>
[johan: add error message ]
Signed-off-by Johan Hovold <[email protected]>
--- drivers/usb/serial/mct_u232.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/serial/mct_u232.c +8 -1
@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port,static int mct_u232_port_probe (struct usb_serial_port *port) { +struct usb_serial *serial = port->serial;struct mct_u232_private *priv; +/* check first to simplify error handling */ +if (!serial->port[1 ] || !serial->port[1 ]->interrupt_in_urb) { +dev_err (&port->dev,"expected endpoint missing\n" ); +return -ENODEV ; + } + priv =kzalloc (sizeof (*priv),GFP_KERNEL );if (!priv)return -ENOMEM ;/* Use second interrupt-in endpoint for reading. */ - priv->read_urb = port->serial->port[1 ]->interrupt_in_urb; + priv->read_urb = serial->port[1 ]->interrupt_in_urb; priv->read_urb->context = port;spin_lock_init (&priv->lock);
Signature · 1 line
2.7.3
Johan Hovold
maintainerPATCH 2/3 USB: cypress_m8: add endpoint sanity check
In reply to a message not in the archiveFrom: Oliver Neukum <[email protected]>
An attack using missing endpoints exists.
CVE-2016-3137
Signed-off-by Oliver Neukum <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
--- drivers/usb/serial/cypress_m8.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/usb/serial/cypress_m8.c +5 -6
@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)struct usb_serial *serial = port->serial;struct cypress_private *priv; +if (!port->interrupt_out_urb || !port->interrupt_in_urb) { +dev_err (&port->dev,"required endpoint is missing\n" ); +return -ENODEV ; + } + priv =kzalloc (sizeof (struct cypress_private ),GFP_KERNEL );if (!priv)return -ENOMEM ;
@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)cypress_set_termios (tty, port, &priv->tmp_termios);/* setup the port and start reading from the device */ -if (!port->interrupt_in_urb) { -dev_err (&port->dev,"%s - interrupt_in_urb is empty!\n" , - __func__); -return -1 ; - } - usb_fill_int_urb(port->interrupt_in_urb, serial->dev, usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), port->interrupt_in_urb->transfer_buffer,
Signature · 1 line
2.7.3
Johan Hovold
maintainerPATCH 3/3 USB: digi_acceleport: do sanity checking for the number of ports
In reply to a message not in the archiveFrom: Oliver Neukum <[email protected]>
The driver can be crashed with devices that expose crafted descriptors with too few endpoints.
See: http://seclists.org/bugtraq/2016/Mar/61
Signed-off-by Oliver Neukum <[email protected]>
[johan: fix OOB endpoint check and add error messages ]
Cc stable <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
--- drivers/usb/serial/digi_acceleport.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/usb/serial/digi_acceleport.c +19 -0
@@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)static int digi_startup (struct usb_serial *serial) { +struct device *dev = &serial->interface->dev;struct digi_serial *serial_priv;int ret; +int i; + +/* check whether the device has the expected number of endpoints */ +if (serial->num_port_pointers < serial->type->num_ports +1 ) { +dev_err (dev,"OOB endpoints missing\n" ); +return -ENODEV ; + } + +for (i =0 ; i < serial->type->num_ports +1 ; i++) { +if (!serial->port[i]->read_urb) { +dev_err (dev,"bulk-in endpoint missing\n" ); +return -ENODEV ; + } +if (!serial->port[i]->write_urb) { +dev_err (dev,"bulk-out endpoint missing\n" ); +return -ENODEV ; + } + } serial_priv =kzalloc (sizeof (*serial_priv),GFP_KERNEL );if (!serial_priv)
Signature · 1 line
2.7.3