[PATCH 3.19.y-ckt 14/56] USB: cypress_m8: add endpoint sanity check

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.19.y-ckt 14/56] USB: cypress_m8: add endpoint sanity check
Date	2016-04-12 23:10 +0200
Message-ID	<rndJp-5Cv-37@gated-at.bofh.it> (permalink)
References	<rndzI-5be-21@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.19.8-ckt19 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Oliver Neukum <oneukum@suse.com>

commit c55aee1bf0e6b6feec8b2927b43f7a09a6d5f754 upstream.

An attack using missing endpoints exists.

CVE-2016-3137

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/serial/cypress_m8.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 01bf533..244acb12 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
 	struct usb_serial *serial = port->serial;
 	struct cypress_private *priv;
 
+	if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
+		dev_err(&port->dev, "required endpoint is missing\n");
+		return -ENODEV;
+	}
+
 	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
 		cypress_set_termios(tty, port, &priv->tmp_termios);
 
 	/* setup the port and start reading from the device */
-	if (!port->interrupt_in_urb) {
-		dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
-			__func__);
-		return -1;
-	}
-
 	usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
 		usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
 		port->interrupt_in_urb->transfer_buffer,
-- 
2.7.4

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt19 stable review Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 04/56] ALSA: hda - Fix white noise on Asus N750JV headphone Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 01/56] [stable-only] Revert "spi: rockchip: modify DMA max burst to 1" Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 10/56] pinctrl: sh-pfc: only use dummy states for non-DT platforms Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 47/56] efi: Make our variable validation list include the guid Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 55/56] mwifiex: fix corner case association failure Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 53/56] perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 42/56] Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 50/56] lib/ucs2_string: Correct ucs2 -> utf8 conversion Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 40/56] pinctrl: nomadik: fix pull debug print inversion Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 54/56] ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 27/56] ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 15/56] USB: digi_acceleport: do sanity checking for the number of ports Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 44/56] lib/ucs2_string: Add ucs2 -> utf8 helper functions Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 51/56] ipr: Fix out-of-bounds null overwrite Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 43/56] KVM: x86: move steal time initialization to vcpu entry time Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 30/56] drm/dp: move hw_mutex up the call stack Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 49/56] efi: Add pstore variables to the deletion whitelist Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 45/56] efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 41/56] ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 14/56] USB: cypress_m8: add endpoint sanity check Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 52/56] ipr: Fix regression when loading firmware Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 48/56] efi: Make efivarfs entries immutable by default Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 56/56] net: phy: at803x: Request 'reset' GPIO only for AT8030 PHY Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 46/56] efi: Do variable name validation tests in utf8 Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 38/56] ip6_tunnel: set rtnl_link_ops before calling register_netdevice Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 28/56] ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 12/56] usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 16/56] ext4: add lockdep annotations for i_data_sem Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 25/56] parisc: Avoid function pointers for kernel exception routines Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 18/56] mm: fix invalid node in alloc_migrate_target() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 19/56] iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 35/56] gpio: pca953x: Use correct u16 value for register word write Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 23/56] USB: serial: cp210x: Adding GE Healthcare Device ID Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 22/56] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 34/56] ext4: ignore quota mount options if the quota feature is enabled Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 13/56] USB: mct_u232: add sanity checking in probe Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 29/56] sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 20/56] xen/events: Mask a moving irq Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 17/56] ALSA: timer: Use mod_timer() for rearming the system timer Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 26/56] drm/radeon: add a dpm quirk for all R7 370 parts Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 37/56] parisc: Unbreak handling exceptions from kernel modules Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 32/56] ALSA: hda - fix front mic problem for a HP desktop Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 39/56] net: bcmgenet: fix skb_len in bcmgenet_xmit_single() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 09/56] powerpc/mm: Fixup preempt underflow with huge pages Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 33/56] KVM: x86: Inject pending interrupt even if pending nmi exist Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 21/56] rbd: use GFP_NOIO consistently for request allocations Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 24/56] USB: option: add "D-Link DWM-221 B1" device id Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 31/56] drm/udl: Use unlocked gem unreferencing Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 36/56] parisc: Fix kernel crash with reversed copy_from_user() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 11/56] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 05/56] ALSA: hda - Apply fix for white noise on Asus N550JV, too Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 07/56] hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 02/56] PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 08/56] drm/radeon: add another R7 370 quirk Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 06/56] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5 Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 03/56] ALSA: hda - Asus N750JV external subwoofer fixup Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200

csiph-web