Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1624310
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 129/145] USB: uss720: fix NULL-deref at probe |
| Date | 2017-04-16 13:10 +0200 |
| Message-ID | <twQe5-2WB-7@gated-at.bofh.it> (permalink) |
| References | <twQ4p-2E7-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit f259ca3eed6e4b79ac3d5c5c9fb259fb46e86217 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Note that the endpoint access that causes the NULL-deref is currently
only used for debugging purposes during probe so the oops only happens
when dynamic debugging is enabled. This means the driver could be
rewritten to continue to accept device with only two endpoints, should
such devices exist.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/uss720.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -715,6 +715,11 @@ static int uss720_probe(struct usb_inter
interface = intf->cur_altsetting;
+ if (interface->desc.bNumEndpoints < 3) {
+ usb_put_dev(usbdev);
+ return -ENODEV;
+ }
+
/*
* Allocate parport interface
*/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 099/145] drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 032/145] selinux: fix off-by-one in setprocattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 140/145] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 041/145] [PATCH 087/760] net: pktgen: remove rcu locking in pktgen_change_name() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 084/145] usb: dwc3: gadget: make Set Endpoint Configuration macros safe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 143/145] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 125/145] KVM: s390: Fix guest migration for huge guests resulting in panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 104/145] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 095/145] padata: avoid race in reordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 083/145] usb: gadget: dummy_hcd: clear usb_gadget region before registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 129/145] USB: uss720: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 132/145] USB: wusbcore: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 109/145] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 141/145] net: fix socket refcounting in skb_complete_wifi_ack() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 101/145] cpmac: remove hopeless #warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 110/145] net/packet: fix overflow in check for priv area size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 117/145] crypto: cryptd - Assign statesize properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 098/145] drm/ast: Call open_key before enable_mmio in POST code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 078/145] libceph: use BUG() instead of BUG_ON(1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 123/145] s390: make setup_randomness work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 075/145] nlm: Ensure callback code also checks that the files match Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 130/145] USB: lvtest: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 137/145] MIPS: DEC: Avoid la pseudo-instruction in delay slots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 139/145] libceph: dont set weight to IN when OSD is destroyed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 111/145] usb: hub: Wait for connection to be reestablished after port reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 094/145] dm: flush queued bios when process blocks to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 082/145] mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 135/145] MIPS: ip27: Disable qlge driver in defconfig Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 091/145] USB: serial: io_ti: fix NULL-deref in interrupt callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 118/145] crypto: mcryptd - Fix load failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 122/145] s390: TASK_SIZE for kernel threads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 115/145] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 106/145] ipv4: mask tos for input route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 134/145] USB: fix linked-list corruption in rh_call_control() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 102/145] tracing: Add #undef to fix compile error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 136/145] MIPS: ip22: Fix ip28 build for modern gcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 052/145] drivers: staging: nvec: remove bogus reset command for PS/2 interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 042/145] [PATCH 091/760] ipv4: disable BH in set_ping_group_range() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 090/145] USB: iowarrior: fix NULL-deref in write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 035/145] [PATCH 074/760] tcp: fix a compile error in DBGUNDO() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 060/145] lib/vsprintf.c: improve sanity check in vsnprintf() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 030/145] pwm: Unexport children before chip removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 068/145] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 071/145] Bluetooth: Add another AR3012 04ca:3018 device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 057/145] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 087/145] USB: serial: safe_serial: fix information leak in completion handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 070/145] KVM: s390: Disable dirty log retrieval for UCONTROL guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 089/145] USB: iowarrior: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 046/145] [PATCH 083/760] netlink: do not enter direct reclaim from netlink_dump() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 065/145] xfrm: policy: init locks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 074/145] USB: serial: digi_acceleport: fix OOB-event processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 076/145] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 007/145] ipv4: keep skb->dst around in presence of IP options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 050/145] coredump: fix unfreezable coredumping task Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 043/145] [PATCH 093/760] net: sctp, forbid negative length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 072/145] IB/ipoib: Fix deadlock between rmmod and set_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 069/145] serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 047/145] ASoC: cs4270: fix DAPM stream name mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 054/145] USB: cdc-acm: fix TIOCMIWAIT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 036/145] [PATCH 075/760] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 005/145] tcp: fix 0 divide in __tcp_select_window() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 085/145] usb: gadget: function: f_fs: pass companion descriptor along Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 063/145] cancel the setfilesize transation when io error happen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 051/145] staging: iio: ad5933: avoid uninitialized variable in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 064/145] raid10: increment write counter after bio is split Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 059/145] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 037/145] [PATCH 076/760] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 049/145] swapfile: fix memory corruption via malformed swapfile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 062/145] tty: n_hdlc: get rid of racy n_hdlc.tbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 028/145] smc91x: avoid self-comparison warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 015/145] [PATCH 084/760] ipv6: tcp: restore IP6CB for pktoptions skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 012/145] ping: fix a null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 020/145] tcp: fix overflow in __tcp_retransmit_skb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 019/145] usb: chipidea: move the lock initialization to core file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 002/145] can: Fix kernel panic at security_sock_rcv_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 031/145] HID: usbhid: add ATEN CS962 to list of quirky devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 027/145] drm/exynos: fix error handling in exynos_drm_subdrv_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 033/145] fbdev: color map copying bounds checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 023/145] ALSA: usb-audio: Add quirk for Syntek STK1160 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-17 01:40 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 09:00 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Amit Pundir <amit.pundir@linaro.org> - 2017-04-17 10:10 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 10:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-17 20:20 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-18 07:00 +0200
csiph-web