USB: fix missing endpoint sanity checks

This series fixes a number of NULL-pointer dereferences due to missing endpoint sanity checks that can be triggered by a malicious device.

Johan

Johan Hovold (6):
USB: idmouse: fix NULL-deref at probe
USB: lvtest: fix NULL-deref at probe
USB: uss720: fix NULL-deref at probe
USB: wusbcore: fix NULL-deref at probe
uwb: hwa-rc: fix NULL-deref at probe
uwb: i1480-dfu: fix NULL-deref at probe

 drivers/usb/misc/idmouse.c   | 3 +++
 drivers/usb/misc/lvstest.c   | 4 ++++
 drivers/usb/misc/uss720.c    | 5 +++++
 drivers/usb/wusbcore/wa-hc.c | 3 +++
 drivers/uwb/hwa-rc.c         | 3 +++
 drivers/uwb/i1480/dfu/usb.c  | 3 +++
 6 files changed, 21 insertions(+)

2.12.0

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.

---
 drivers/usb/misc/idmouse.c | 3 +++
 1 file changed, 3 insertions(+)

index 8b9fd7534f69..502bfe30a077 100644
@@ -347,6 +347,9 @@ static int idmouse_probe(struct usb_interface *interface,
 	if (iface_desc->desc.bInterfaceClass != 0x0A)
 		return -ENODEV;
 
+	if (iface_desc->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	/* allocate memory for our device state and initialize it */
 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 	if (dev == NULL)

2.12.0

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should the probed device lack endpoints.

Note that this driver does not bind to any devices by default.

---
 drivers/usb/misc/lvstest.c | 4 ++++
 1 file changed, 4 insertions(+)

index 77176511658f..d3d124753266 100644
@@ -366,6 +366,10 @@ static int lvs_rh_probe(struct usb_interface *intf,
 
 	hdev = interface_to_usbdev(intf);
 	desc = intf->cur_altsetting;
+
+	if (desc->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	endpoint = &desc->endpoint[0].desc;
 
 	/* valid only for SS root hub */

2.12.0

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.

Note that the endpoint access that causes the NULL-deref is currently only used for debugging purposes during probe so the oops only happens when dynamic debugging is enabled. This means the driver could be rewritten to continue to accept device with only two endpoints, should such devices exist.

---
 drivers/usb/misc/uss720.c | 5 +++++
 1 file changed, 5 insertions(+)

index e45a3a680db8..07014cad6dbe 100644
@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf,
 
 	interface = intf->cur_altsetting;
 
+	if (interface->desc.bNumEndpoints < 3) {
+		usb_put_dev(usbdev);
+		return -ENODEV;
+	}
+
 	/*
 	 * Allocate parport interface 
 	 */

2.12.0

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.

This specifically fixes the NULL-pointer dereference when probing HWA HC devices.

---
 drivers/usb/wusbcore/wa-hc.c | 3 +++
 1 file changed, 3 insertions(+)

index 252c7bd9218a..d01496fd27fe 100644
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface,
 	int result;
 	struct device *dev = &iface->dev;
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+		return -ENODEV;
+
 	result = wa_rpipes_create(wa);
 	if (result < 0)
 		goto error_rpipes_create;

2.12.0

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.

Note that the dereference happens in the start callback which is called during probe.

---
 drivers/uwb/hwa-rc.c | 3 +++
 1 file changed, 3 insertions(+)

index 0aa6c3c29d17..35a1e777b449 100644
@@ -823,6 +823,9 @@ static int hwarc_probe(struct usb_interface *iface,
 	struct hwarc *hwarc;
 	struct device *dev = &iface->dev;
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	result = -ENOMEM;
 	uwb_rc = uwb_rc_alloc();
 	if (uwb_rc == NULL) {

2.12.0

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.

Note that the dereference happens in the cmd and wait_init_done callbacks which are called during probe.

---
 drivers/uwb/i1480/dfu/usb.c | 3 +++
 1 file changed, 3 insertions(+)

index 2bfc846ac071..6345e85822a4 100644
@@ -362,6 +362,9 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
 				 result);
 	}
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	result = -ENOMEM;
 	i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL);
 	if (i1480_usb == NULL) {

2.12.0