patch "USB: core: harden cdc_parse_cdc_header" added to usb-linus

This is a note to let you know that I've just added the patch titled

USB: core: harden cdc_parse_cdc_header

to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From: Greg Kroah-Hartman <[email protected]>
Date: Thu, 21 Sep 2017 16:58:48 +0200
Subject: USB: core: harden cdc_parse_cdc_header

Andrey Konovalov reported a possible out-of-bounds problem for the cdc_parse_cdc_header function. He writes:
It looks like cdc_parse_cdc_header() doesn't validate buflen before accessing buffer[1], buffer[2] and so on. The only check present is while (buflen > 0).

So fix this issue up by properly validating the buffer length matches what the descriptor says it is.

---
 drivers/usb/core/message.c | 4 ++++
 1 file changed, 4 insertions(+)

index 4c38ea41ae96..371a07d874a3 100644
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
 			elength = 1;
 			goto next_desc;
 		}
+		if ((buflen < elength) || (elength < 3)) {
+			dev_err(&intf->dev, "invalid descriptor buffer length\n");
+			break;
+		}
 		if (buffer[1] != USB_DT_CS_INTERFACE) {
 			dev_err(&intf->dev, "skipping garbage\n");
 			goto next_desc;

2.14.1