Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() From: Shuah Khan Message-Id: <20181005221744.21605-2-shuah@kernel.org> Date: Fri, 5 Oct 2018 16:17:44 -0600 To: shuah@kernel.org, gregkh@linuxfoundation.org, valentina.manea.m@gmail.com Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org List-ID: dmhjaV9odWJfY29udHJvbCgpIGFjY2Vzc2VzIHBvcnRfc3RhdHVzIGFycmF5IHdpdGggb3V0IG9m IGJvdW5kcyBwb3J0CnZhbHVlLiBGaXggaXQgdG8gcmVmZXJlbmNlIHBvcnRfc3RhdHVzW10gb25s eSB3aXRoIGEgdmFsaWQgcmhwb3J0IHZhbHVlCndoZW4gaW52YWxpZF9yaHBvcnQgZmxhZyBpcyB0 cnVlLgoKVGhlIGludmFsaWRfcmhwb3J0IGZsYWcgaXMgc2V0IGVhcmx5IG9uIGFmdGVyIGRldGVj dGluZyBpbiBwb3J0IHZhbHVlCmlzIHdpdGhpbiB0aGUgYm91bmRzIG9yIG5vdC4KClRoZSBmb2xs b3dpbmcgaXMgdXNlZCByZXByb2R1Y2UgdGhlIHByb2JsZW0gYW5kIHZlcmlmeSB0aGUgZml4OgpD IHJlcHJvZHVjZXI6ICAgaHR0cHM6Ly9zeXprYWxsZXIuYXBwc3BvdC5jb20veC9yZXByby5jP3g9 MTRlZDhhYjY0MDAwMDAKClJlcG9ydGVkLWJ5OiBzeXpib3QrYmNjYzFmZTEwYjcwZmFkYzc4ZDBA c3l6a2FsbGVyLmFwcHNwb3RtYWlsLmNvbQpTaWduZWQtb2ZmLWJ5OiBTaHVhaCBLaGFuIChTYW1z dW5nIE9TRykgPHNodWFoQGtlcm5lbC5vcmc+Ci0tLQogZHJpdmVycy91c2IvdXNiaXAvdmhjaV9o Y2QuYyB8IDU3ICsrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLS0tLS0tLQogMSBmaWxlIGNo YW5nZWQsIDQyIGluc2VydGlvbnMoKyksIDE1IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2Ry aXZlcnMvdXNiL3VzYmlwL3ZoY2lfaGNkLmMgYi9kcml2ZXJzL3VzYi91c2JpcC92aGNpX2hjZC5j CmluZGV4IGQxMWYzZjhkYWQ0MC4uMWU1OTJlYzk0YmE0IDEwMDY0NAotLS0gYS9kcml2ZXJzL3Vz Yi91c2JpcC92aGNpX2hjZC5jCisrKyBiL2RyaXZlcnMvdXNiL3VzYmlwL3ZoY2lfaGNkLmMKQEAg LTMxOCw4ICszMTgsOSBAQCBzdGF0aWMgaW50IHZoY2lfaHViX2NvbnRyb2woc3RydWN0IHVzYl9o Y2QgKmhjZCwgdTE2IHR5cGVSZXEsIHUxNiB3VmFsdWUsCiAJc3RydWN0IHZoY2lfaGNkCSp2aGNp X2hjZDsKIAlzdHJ1Y3QgdmhjaQkqdmhjaTsKIAlpbnQgICAgICAgICAgICAgcmV0dmFsID0gMDsK LQlpbnQJCXJocG9ydDsKKwlpbnQJCXJocG9ydCA9IC0xOwogCXVuc2lnbmVkIGxvbmcJZmxhZ3M7 CisJYm9vbCBpbnZhbGlkX3JocG9ydCA9IGZhbHNlOwogCiAJdTMyIHByZXZfcG9ydF9zdGF0dXNb VkhDSV9IQ19QT1JUU107CiAKQEAgLTMzNCw5ICszMzUsMTkgQEAgc3RhdGljIGludCB2aGNpX2h1 Yl9jb250cm9sKHN0cnVjdCB1c2JfaGNkICpoY2QsIHUxNiB0eXBlUmVxLCB1MTYgd1ZhbHVlLAog CXVzYmlwX2RiZ192aGNpX3JoKCJ0eXBlUmVxICV4IHdWYWx1ZSAleCB3SW5kZXggJXhcbiIsIHR5 cGVSZXEsIHdWYWx1ZSwKIAkJCSAgd0luZGV4KTsKIAotCWlmICh3SW5kZXggPiBWSENJX0hDX1BP UlRTKQotCQlwcl9lcnIoImludmFsaWQgcG9ydCBudW1iZXIgJWRcbiIsIHdJbmRleCk7Ci0Jcmhw b3J0ID0gd0luZGV4IC0gMTsKKwkvKgorCSAqIHdJbmRleCBjYW4gYmUgMCBmb3Igc29tZSByZXF1 ZXN0IHR5cGVzICh0eXBlUmVxKS4gcmhwb3J0IGlzCisJICogaW4gdmFsaWQgcmFuZ2Ugd2hlbiB3 SW5kZXggPj0gMSBhbmQgPCBWSENJX0hDX1BPUlRTLgorCSAqCisJICogUmVmZXJlbmNlIHBvcnRf c3RhdHVzW10gb25seSB3aXRoIHZhbGlkIHJocG9ydCB3aGVuCisJICogaW52YWxpZF9yaHBvcnQg aXMgZmFsc2UuCisJICovCisJaWYgKHdJbmRleCA8IDEgfHwgd0luZGV4ID4gVkhDSV9IQ19QT1JU UykgeworCQlpbnZhbGlkX3JocG9ydCA9IHRydWU7CisJCWlmICh3SW5kZXggPiBWSENJX0hDX1BP UlRTKQorCQkJcHJfZXJyKCJpbnZhbGlkIHBvcnQgbnVtYmVyICVkXG4iLCB3SW5kZXgpOworCX0g ZWxzZQorCQlyaHBvcnQgPSB3SW5kZXggLSAxOwogCiAJdmhjaV9oY2QgPSBoY2RfdG9fdmhjaV9o Y2QoaGNkKTsKIAl2aGNpID0gdmhjaV9oY2QtPnZoY2k7CkBAIC0zNDUsOCArMzU2LDkgQEAgc3Rh dGljIGludCB2aGNpX2h1Yl9jb250cm9sKHN0cnVjdCB1c2JfaGNkICpoY2QsIHUxNiB0eXBlUmVx LCB1MTYgd1ZhbHVlLAogCiAJLyogc3RvcmUgb2xkIHN0YXR1cyBhbmQgY29tcGFyZSBub3cgYW5k IG9sZCBsYXRlciAqLwogCWlmICh1c2JpcF9kYmdfZmxhZ192aGNpX3JoKSB7Ci0JCW1lbWNweShw cmV2X3BvcnRfc3RhdHVzLCB2aGNpX2hjZC0+cG9ydF9zdGF0dXMsCi0JCQlzaXplb2YocHJldl9w b3J0X3N0YXR1cykpOworCQlpZiAoIWludmFsaWRfcmhwb3J0KQorCQkJbWVtY3B5KHByZXZfcG9y dF9zdGF0dXMsIHZoY2lfaGNkLT5wb3J0X3N0YXR1cywKKwkJCQlzaXplb2YocHJldl9wb3J0X3N0 YXR1cykpOwogCX0KIAogCXN3aXRjaCAodHlwZVJlcSkgewpAQCAtMzU0LDggKzM2NiwxMCBAQCBz dGF0aWMgaW50IHZoY2lfaHViX2NvbnRyb2woc3RydWN0IHVzYl9oY2QgKmhjZCwgdTE2IHR5cGVS ZXEsIHUxNiB3VmFsdWUsCiAJCXVzYmlwX2RiZ192aGNpX3JoKCIgQ2xlYXJIdWJGZWF0dXJlXG4i KTsKIAkJYnJlYWs7CiAJY2FzZSBDbGVhclBvcnRGZWF0dXJlOgotCQlpZiAocmhwb3J0IDwgMCkK KwkJaWYgKGludmFsaWRfcmhwb3J0KSB7CisJCQlwcl9lcnIoImludmFsaWQgcG9ydCBudW1iZXIg JWRcbiIsIHdJbmRleCk7CiAJCQlnb3RvIGVycm9yOworCQl9CiAJCXN3aXRjaCAod1ZhbHVlKSB7 CiAJCWNhc2UgVVNCX1BPUlRfRkVBVF9TVVNQRU5EOgogCQkJaWYgKGhjZC0+c3BlZWQgPT0gSENE X1VTQjMpIHsKQEAgLTQxNSw5ICs0MjksMTAgQEAgc3RhdGljIGludCB2aGNpX2h1Yl9jb250cm9s KHN0cnVjdCB1c2JfaGNkICpoY2QsIHUxNiB0eXBlUmVxLCB1MTYgd1ZhbHVlLAogCQlicmVhazsK IAljYXNlIEdldFBvcnRTdGF0dXM6CiAJCXVzYmlwX2RiZ192aGNpX3JoKCIgR2V0UG9ydFN0YXR1 cyBwb3J0ICV4XG4iLCB3SW5kZXgpOwotCQlpZiAod0luZGV4IDwgMSkgeworCQlpZiAoaW52YWxp ZF9yaHBvcnQpIHsKIAkJCXByX2VycigiaW52YWxpZCBwb3J0IG51bWJlciAlZFxuIiwgd0luZGV4 KTsKIAkJCXJldHZhbCA9IC1FUElQRTsKKwkJCWdvdG8gZXJyb3I7CiAJCX0KIAogCQkvKiB3ZSBk byBub3QgY2FyZSBhYm91dCByZXN1bWUuICovCkBAIC01MTMsMTYgKzUyOCwyMCBAQCBzdGF0aWMg aW50IHZoY2lfaHViX2NvbnRyb2woc3RydWN0IHVzYl9oY2QgKmhjZCwgdTE2IHR5cGVSZXEsIHUx NiB3VmFsdWUsCiAJCQkJZ290byBlcnJvcjsKIAkJCX0KIAotCQkJaWYgKHJocG9ydCA8IDApCisJ CQlpZiAoaW52YWxpZF9yaHBvcnQpIHsKKwkJCQlwcl9lcnIoImludmFsaWQgcG9ydCBudW1iZXIg JWRcbiIsIHdJbmRleCk7CiAJCQkJZ290byBlcnJvcjsKKwkJCX0KIAogCQkJdmhjaV9oY2QtPnBv cnRfc3RhdHVzW3JocG9ydF0gfD0gVVNCX1BPUlRfU1RBVF9TVVNQRU5EOwogCQkJYnJlYWs7CiAJ CWNhc2UgVVNCX1BPUlRfRkVBVF9QT1dFUjoKIAkJCXVzYmlwX2RiZ192aGNpX3JoKAogCQkJCSIg U2V0UG9ydEZlYXR1cmU6IFVTQl9QT1JUX0ZFQVRfUE9XRVJcbiIpOwotCQkJaWYgKHJocG9ydCA8 IDApCisJCQlpZiAoaW52YWxpZF9yaHBvcnQpIHsKKwkJCQlwcl9lcnIoImludmFsaWQgcG9ydCBu dW1iZXIgJWRcbiIsIHdJbmRleCk7CiAJCQkJZ290byBlcnJvcjsKKwkJCX0KIAkJCWlmIChoY2Qt PnNwZWVkID09IEhDRF9VU0IzKQogCQkJCXZoY2lfaGNkLT5wb3J0X3N0YXR1c1tyaHBvcnRdIHw9 IFVTQl9TU19QT1JUX1NUQVRfUE9XRVI7CiAJCQllbHNlCkBAIC01MzEsOCArNTUwLDEwIEBAIHN0 YXRpYyBpbnQgdmhjaV9odWJfY29udHJvbChzdHJ1Y3QgdXNiX2hjZCAqaGNkLCB1MTYgdHlwZVJl cSwgdTE2IHdWYWx1ZSwKIAkJY2FzZSBVU0JfUE9SVF9GRUFUX0JIX1BPUlRfUkVTRVQ6CiAJCQl1 c2JpcF9kYmdfdmhjaV9yaCgKIAkJCQkiIFNldFBvcnRGZWF0dXJlOiBVU0JfUE9SVF9GRUFUX0JI X1BPUlRfUkVTRVRcbiIpOwotCQkJaWYgKHJocG9ydCA8IDApCisJCQlpZiAoaW52YWxpZF9yaHBv cnQpIHsKKwkJCQlwcl9lcnIoImludmFsaWQgcG9ydCBudW1iZXIgJWRcbiIsIHdJbmRleCk7CiAJ CQkJZ290byBlcnJvcjsKKwkJCX0KIAkJCS8qIEFwcGxpY2FibGUgb25seSBmb3IgVVNCMy4wIGh1 YiAqLwogCQkJaWYgKGhjZC0+c3BlZWQgIT0gSENEX1VTQjMpIHsKIAkJCQlwcl9lcnIoIlVTQl9Q T1JUX0ZFQVRfQkhfUE9SVF9SRVNFVCByZXEgbm90ICIKQEAgLTU0Myw4ICs1NjQsMTAgQEAgc3Rh dGljIGludCB2aGNpX2h1Yl9jb250cm9sKHN0cnVjdCB1c2JfaGNkICpoY2QsIHUxNiB0eXBlUmVx LCB1MTYgd1ZhbHVlLAogCQljYXNlIFVTQl9QT1JUX0ZFQVRfUkVTRVQ6CiAJCQl1c2JpcF9kYmdf dmhjaV9yaCgKIAkJCQkiIFNldFBvcnRGZWF0dXJlOiBVU0JfUE9SVF9GRUFUX1JFU0VUXG4iKTsK LQkJCWlmIChyaHBvcnQgPCAwKQorCQkJaWYgKGludmFsaWRfcmhwb3J0KSB7CisJCQkJcHJfZXJy KCJpbnZhbGlkIHBvcnQgbnVtYmVyICVkXG4iLCB3SW5kZXgpOwogCQkJCWdvdG8gZXJyb3I7CisJ CQl9CiAJCQkvKiBpZiBpdCdzIGFscmVhZHkgZW5hYmxlZCwgZGlzYWJsZSAqLwogCQkJaWYgKGhj ZC0+c3BlZWQgPT0gSENEX1VTQjMpIHsKIAkJCQl2aGNpX2hjZC0+cG9ydF9zdGF0dXNbcmhwb3J0 XSA9IDA7CkBAIC01NjUsOCArNTg4LDEwIEBAIHN0YXRpYyBpbnQgdmhjaV9odWJfY29udHJvbChz dHJ1Y3QgdXNiX2hjZCAqaGNkLCB1MTYgdHlwZVJlcSwgdTE2IHdWYWx1ZSwKIAkJZGVmYXVsdDoK IAkJCXVzYmlwX2RiZ192aGNpX3JoKCIgU2V0UG9ydEZlYXR1cmU6IGRlZmF1bHQgJWRcbiIsCiAJ CQkJCSAgd1ZhbHVlKTsKLQkJCWlmIChyaHBvcnQgPCAwKQorCQkJaWYgKGludmFsaWRfcmhwb3J0 KSB7CisJCQkJcHJfZXJyKCJpbnZhbGlkIHBvcnQgbnVtYmVyICVkXG4iLCB3SW5kZXgpOwogCQkJ CWdvdG8gZXJyb3I7CisJCQl9CiAJCQlpZiAoaGNkLT5zcGVlZCA9PSBIQ0RfVVNCMykgewogCQkJ CWlmICgodmhjaV9oY2QtPnBvcnRfc3RhdHVzW3JocG9ydF0gJgogCQkJCSAgICAgVVNCX1NTX1BP UlRfU1RBVF9QT1dFUikgIT0gMCkgewpAQCAtNjA4LDcgKzYzMyw3IEBAIHN0YXRpYyBpbnQgdmhj aV9odWJfY29udHJvbChzdHJ1Y3QgdXNiX2hjZCAqaGNkLCB1MTYgdHlwZVJlcSwgdTE2IHdWYWx1 ZSwKIAlpZiAodXNiaXBfZGJnX2ZsYWdfdmhjaV9yaCkgewogCQlwcl9kZWJ1ZygicG9ydCAlZFxu Iiwgcmhwb3J0KTsKIAkJLyogT25seSBkdW1wIHZhbGlkIHBvcnQgc3RhdHVzICovCi0JCWlmIChy aHBvcnQgPj0gMCkgeworCQlpZiAoIWludmFsaWRfcmhwb3J0KSB7CiAJCQlkdW1wX3BvcnRfc3Rh dHVzX2RpZmYocHJldl9wb3J0X3N0YXR1c1tyaHBvcnRdLAogCQkJCQkgICAgICB2aGNpX2hjZC0+ cG9ydF9zdGF0dXNbcmhwb3J0XSwKIAkJCQkJICAgICAgaGNkLT5zcGVlZCA9PSBIQ0RfVVNCMyk7 CkBAIC02MTgsOCArNjQzLDEwIEBAIHN0YXRpYyBpbnQgdmhjaV9odWJfY29udHJvbChzdHJ1Y3Qg dXNiX2hjZCAqaGNkLCB1MTYgdHlwZVJlcSwgdTE2IHdWYWx1ZSwKIAogCXNwaW5fdW5sb2NrX2ly cXJlc3RvcmUoJnZoY2ktPmxvY2ssIGZsYWdzKTsKIAotCWlmICgodmhjaV9oY2QtPnBvcnRfc3Rh dHVzW3JocG9ydF0gJiBQT1JUX0NfTUFTSykgIT0gMCkKKwlpZiAoIWludmFsaWRfcmhwb3J0ICYm CisJICAgICh2aGNpX2hjZC0+cG9ydF9zdGF0dXNbcmhwb3J0XSAmIFBPUlRfQ19NQVNLKSAhPSAw KSB7CiAJCXVzYl9oY2RfcG9sbF9yaF9zdGF0dXMoaGNkKTsKKwl9CiAKIAlyZXR1cm4gcmV0dmFs OwogfQo=