Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1582200

[PATCH 3.2 025/126] usb: misc: legousbtower: Fix NULL pointer deference

From Ben Hutchings <ben@decadent.org.uk>
Newsgroups linux.kernel
Subject [PATCH 3.2 025/126] usb: misc: legousbtower: Fix NULL pointer deference
Date 2017-02-16 01:50 +0100
Message-ID <tbiqL-7aO-35@gated-at.bofh.it> (permalink)
References <tbgIi-5XZ-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


3.2.85-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2fae9e5a7babada041e2e161699ade2447a01989 upstream.

This patch fixes a NULL pointer dereference caused by a race codition in
the probe function of the legousbtower driver. It re-structures the
probe function to only register the interface after successfully reading
the board's firmware ID.

The probe function does not deregister the usb interface after an error
receiving the devices firmware ID. The device file registered
(/dev/usb/legousbtower%d) may be read/written globally before the probe
function returns. When tower_delete is called in the probe function
(after an r/w has been initiated), core dev structures are deleted while
the file operation functions are still running. If the 0 address is
mappable on the machine, this vulnerability can be used to create a
Local Priviege Escalation exploit via a write-what-where condition by
remapping dev->interrupt_out_buffer in tower_write. A forged USB device
and local program execution would be required for LPE. The USB device
would have to delay the control message in tower_probe and accept
the control urb in tower_open whilst guest code initiated a write to the
device file as tower_delete is called from the error in tower_probe.

This bug has existed since 2003. Patch tested by emulated device.

Reported-by: James Patrick-Evans <james@jmp-e.com>
Tested-by: James Patrick-Evans <james@jmp-e.com>
Signed-off-by: James Patrick-Evans <james@jmp-e.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: keep using err()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/misc/legousbtower.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -951,24 +951,6 @@ static int tower_probe (struct usb_inter
 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
 
-	/* we can register the device now, as it is ready */
-	usb_set_intfdata (interface, dev);
-
-	retval = usb_register_dev (interface, &tower_class);
-
-	if (retval) {
-		/* something prevented us from registering this driver */
-		err ("Not able to get a minor for this device.");
-		usb_set_intfdata (interface, NULL);
-		goto error;
-	}
-	dev->minor = interface->minor;
-
-	/* let the user know what node this device is now attached to */
-	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
-		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
-		 USB_MAJOR, dev->minor);
-
 	/* get the firmware version and log it */
 	result = usb_control_msg (udev,
 				  usb_rcvctrlpipe(udev, 0),
@@ -989,6 +971,23 @@ static int tower_probe (struct usb_inter
 		 get_version_reply.minor,
 		 le16_to_cpu(get_version_reply.build_no));
 
+	/* we can register the device now, as it is ready */
+	usb_set_intfdata (interface, dev);
+
+	retval = usb_register_dev (interface, &tower_class);
+
+	if (retval) {
+		/* something prevented us from registering this driver */
+		err ("Not able to get a minor for this device.");
+		usb_set_intfdata (interface, NULL);
+		goto error;
+	}
+	dev->minor = interface->minor;
+
+	/* let the user know what node this device is now attached to */
+	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
+		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
+		 USB_MAJOR, dev->minor);
 
 exit:
 	dbg(2, "%s: leave, return value 0x%.8lx (dev)", __func__, (long) dev);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 111/126] lockdep: Silence warning if CONFIG_LOCKDEP  isn't set Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 095/126] locking/rtmutex: Prevent dequeue vs. unlock race Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 057/126] scsi: arcmsr: Send SYNCHRONIZE_CACHE command  to firmware Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 110/126] perf: Fix perf_event_for_each() to use sibling Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 098/126] net: ping: check minimum size on ICMP header  length Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 114/126] perf/core: Fix concurrent sys_perf_event_open()  vs. 'move_group' race Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
    Re: [PATCH 3.2 114/126] perf/core: Fix concurrent  sys_perf_event_open() vs. 'move_group' race Ben Hutchings <ben@decadent.org.uk> - 2017-02-21 01:50 +0100
  [PATCH 3.2 085/126] Fix USB CB/CBI storage devices with  CONFIG_VMAP_STACK=y Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 124/126] sg_write()/bsg_write() is not fit to be  called under KERNEL_DS Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 053/126] scsi: megaraid_sas: Fix data integrity  failure for JBOD (passthrough) devices Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 112/126] perf: Fix event->ctx locking Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 089/126] IB/uverbs: Fix leak of XRC target QPs Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 037/126] fuse: fix killing s[ug]id in setattr Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 026/126] net/mlx4_core: Fix deadlock when switching  between polling and event fw commands Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 047/126] ubifs: Abort readdir upon error Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 003/126] zfcp: fix ELS/GS request&response length for  hardware data router Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 065/126] ubifs: Fix regression in ubifs_readdir() Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 046/126] ubifs: Fix xattr_names length in exit paths Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 039/126] crypto: gcm - Fix IV buffer size in  crypto_gcm_setkey Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 015/126] [media] mb86a20s: fix the locking logic Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 049/126] batman-adv: fix splat on disabling an interface Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
    Re: [PATCH 3.2 049/126] batman-adv: fix splat on disabling an  interface Linus Lüssing <linus.luessing@c0d3.blue> - 2017-02-16 08:00 +0100
      Re: [PATCH 3.2 049/126] batman-adv: fix splat on disabling an  interface Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 17:10 +0100
  [PATCH 3.2 005/126] zfcp: retain trace level for SCSI and HBA FSF  response records Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 032/126] powerpc/vdso64: Use double word compare on  pointers Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 027/126] ALSA: usb-audio: Extend DragonFly dB scale  quirk to cover other variants Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 061/126] vt: clear selection before resizing Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 040/126] powerpc/64: Fix incorrect return value from  __copy_tofrom_user Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 044/126] isofs: Do not return EACCES for unknown  filesystems Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 030/126] USB: serial: cp210x: Add ID for a Juniper console Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 034/126] s390/con3270: fix use of uninitialised data Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 016/126] [media] cx231xx: don't return error on success Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 033/126] ext4: release bh in make_indexed_dir Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 035/126] s390/con3270: fix insufficient space padding Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 024/126] ALSA: ali5451: Fix out-of-bound position  reporting Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 010/126] zfcp: fix payload trace length for SAN  request&response Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 028/126] regulator: tps65910: Work around silicon  erratum SWCZ010 Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 008/126] zfcp: restore tracing of handle for port and  LUN with HBA records Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 022/126] scsi: ibmvfc: Fix I/O hang when port is not  mapped Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 004/126] zfcp: close window with unblocked rport  during rport gone Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 017/126] [media] cx231xx: fix GPIOs for Pixelview  SBTVD hybrid Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 029/126] mmc: block: don't use CMD23 with very old MMC  cards Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 014/126] rtlwifi: Fix missing country code for Great  Britain Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 011/126] zfcp: trace full payload of all SAN records  (req,resp,iels) Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 002/126] zfcp: fix fc_host port_type with NPIV Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 013/126] rtlwifi: Update regulatory database Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 006/126] zfcp: restore: Dont use 0 to indicate invalid  LUN in rec trace Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 009/126] zfcp: fix D_ID field with actual value on  tracing SAN responses Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 025/126] usb: misc: legousbtower: Fix NULL pointer  deference Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 038/126] fuse: listxattr: verify xattr list Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 043/126] scsi: zfcp: spin_lock_irqsave() is not nestable Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 036/126] fuse: invalidate dir dentry after chmod Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 019/126] reiserfs: Unlock superblock before calling  reiserfs_quota_on_mount() Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  Re: [PATCH 3.2 000/126] 3.2.85-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-02-16 07:10 +0100
    Re: [PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 17:00 +0100

csiph-web