Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1331532

[PATCH 3.13.y-ckt 03/30] [media] usbvision: fix crash on detecting device with invalid configuration

Show all headers | View raw

3.13.11-ckt35 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vladis Dronov <vdronov@redhat.com>

commit fa52bd506f274b7619955917abfde355e3d19ffe upstream.

The usbvision driver crashes when a specially crafted usb device with invalid
number of interfaces or endpoints is detected. This fix adds checks that the
device has proper configuration expected by the driver.

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 72711a1..ad5070a 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -1546,9 +1546,23 @@ static int usbvision_probe(struct usb_interface *intf,
 
 	if (usbvision_device_data[model].interface >= 0)
 		interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
-	else
+	else if (ifnum < dev->actconfig->desc.bNumInterfaces)
 		interface = &dev->actconfig->interface[ifnum]->altsetting[0];
+	else {
+		dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
+		    ifnum, dev->actconfig->desc.bNumInterfaces - 1);
+		ret = -ENODEV;
+		goto err_usb;
+	}
+
+	if (interface->desc.bNumEndpoints < 2) {
+		dev_err(&intf->dev, "interface %d has %d endpoints, but must"
+		    " have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
+		ret = -ENODEV;
+		goto err_usb;
+	}
 	endpoint = &interface->endpoint[1].desc;
+
 	if (!usb_endpoint_xfer_isoc(endpoint)) {
 		dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
 		    __func__, ifnum);
-- 
1.9.1

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt35 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 26/30] ALSA: dummy: Disable switching timer backend via sysfs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 30/30] powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 20/30] USB: option: fix Cinterion AHxx enumeration Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 27/30] drm/vmwgfx: respect 'nomodeset' Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 18/30] ALSA: seq: Degrade the error message for too many opens Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 10/30] usb: cdc-acm: handle unlinked urb in acm read callback Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 07/30] qeth: initialize net_device with carrier off Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 05/30] USB: serial: visor: fix crash on detecting device without write_urbs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 09/30] x86/irq: Call chip->irq_set_affinity in proper context Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 24/30] SCSI: fix crashes in sd and sr runtime PM Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 06/30] ASN.1: Fix non-match detection failure on data overrun Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 22/30] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 17/30] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 14/30] USB: cp210x: add ID for IAI USB to RS485 adaptor Kamal Mostafa <kamal@canonical.com> - 2016-02-10 22:50 +0100
  [PATCH 3.13.y-ckt 02/30] [media] usbvision: fix leak of usb_dev on failure paths in usbvision_probe() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 23:00 +0100
  [PATCH 3.13.y-ckt 08/30] iio: adis_buffer: Fix out-of-bounds memory access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 23:00 +0100
  [PATCH 3.13.y-ckt 03/30] [media] usbvision: fix crash on detecting device with invalid configuration Kamal Mostafa <kamal@canonical.com> - 2016-02-10 23:00 +0100

csiph-web