Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1377095

[PATCH 3.16.y-ckt 10/17] Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

Show all headers | View raw

3.16.7-ckt27 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vladis Dronov <vdronov@redhat.com>

commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream.

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Moritz Muehlenhoff <jmm@inutil.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------
 1 file changed, 30 insertions(+), 6 deletions(-)

diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
index f63341f20b91..e8c6a4842e91 100644
--- a/drivers/input/misc/ati_remote2.c
+++ b/drivers/input/misc/ati_remote2.c
@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
 
 	ar2->udev = udev;
 
+	/* Sanity check, first interface must have an endpoint */
+	if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
+		dev_err(&interface->dev,
+			"%s(): interface 0 must have an endpoint\n", __func__);
+		r = -ENODEV;
+		goto fail1;
+	}
 	ar2->intf[0] = interface;
 	ar2->ep[0] = &alt->endpoint[0].desc;
 
+	/* Sanity check, the device must have two interfaces */
 	ar2->intf[1] = usb_ifnum_to_if(udev, 1);
+	if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
+		dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
+			__func__, udev->actconfig->desc.bNumInterfaces);
+		r = -ENODEV;
+		goto fail1;
+	}
+
 	r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
 	if (r)
 		goto fail1;
+
+	/* Sanity check, second interface must have an endpoint */
 	alt = ar2->intf[1]->cur_altsetting;
+	if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
+		dev_err(&interface->dev,
+			"%s(): interface 1 must have an endpoint\n", __func__);
+		r = -ENODEV;
+		goto fail2;
+	}
 	ar2->ep[1] = &alt->endpoint[0].desc;
 
 	r = ati_remote2_urb_init(ar2);
 	if (r)
-		goto fail2;
+		goto fail3;
 
 	ar2->channel_mask = channel_mask;
 	ar2->mode_mask = mode_mask;
 
 	r = ati_remote2_setup(ar2, ar2->channel_mask);
 	if (r)
-		goto fail2;
+		goto fail3;
 
 	usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
 	strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
 
 	r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
 	if (r)
-		goto fail2;
+		goto fail3;
 
 	r = ati_remote2_input_init(ar2);
 	if (r)
-		goto fail3;
+		goto fail4;
 
 	usb_set_intfdata(interface, ar2);
 
@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
 
 	return 0;
 
- fail3:
+ fail4:
 	sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
- fail2:
+ fail3:
 	ati_remote2_urb_cleanup(ar2);
+ fail2:
 	usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
  fail1:
 	kfree(ar2);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.16.y-ckt stable] Linux 3.16.7-ckt27 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:10 +0200
  [PATCH 3.16.y-ckt 14/17] x86/iopl/64: Properly context-switch IOPL on Xen PV Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:10 +0200
  [PATCH 3.16.y-ckt 13/17] cpu: Provide smpboot_thread_init() on !CONFIG_SMP kernels as well Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:10 +0200
  [PATCH 3.16.y-ckt 15/17] staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:10 +0200
  [PATCH 3.16.y-ckt 16/17] drm/radeon: hold reference to fences in radeon_sa_bo_new (3.17 and older) Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:10 +0200
  [PATCH 3.16.y-ckt 04/17] ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk() Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:10 +0200
  [PATCH 3.16.y-ckt 09/17] ipr: Fix regression when loading firmware Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 02/17] Input: powermate - fix oops with malicious USB descriptors Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 05/17] ALSA: usb-audio: Add sanity checks for endpoint accesses Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 12/17] ceph: fix request time stamp encoding Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 10/17] Input: ati_remote2 - fix crashes on detecting device with invalid descriptor Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 07/17] cpu: Defer smpboot kthread unparking until CPU known to scheduler Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 03/17] USB: iowarrior: fix oops with malicious USB descriptors Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 11/17] USB: cdc-acm: more sanity checking Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 08/17] ipr: Fix out-of-bounds null overwrite Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 01/17] ipv4: Don't do expensive useless work during inetdev destroy. Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200
  [PATCH 3.16.y-ckt 06/17] include/linux/poison.h: fix LIST_POISON{1,2} offset Luis Henriques <luis.henriques@canonical.com> - 2016-04-12 20:20 +0200

csiph-web