linux-kernel - Re: [PATCH] USB: gadget: g_fs: possible invalid pointer reference bug fixed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Jun 2010 14:10:36 +0400
From:	Sergei Shtylyov <sshtylyov@...sta.com>
To:	Michal Nazarewicz <m.nazarewicz@...sung.com>
CC:	linux-usb@...r.kernel.org,
	David Brownell <dbrownell@...rs.sourceforge.net>,
	Kyungmin Park <kyungmin.park@...sung.com>,
	Marek Szyprowski <m.szyprowski@...sung.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] USB: gadget: g_fs: possible invalid pointer reference
 bug fixed

Hello.

Michal Nazarewicz wrote:

> During __gfs_do_config() some invalid pointers may be left
> in usb_configuration::interfaces array from previous calls
> to the __gfs_do_config() for the same configuration.  This
> will always happen if an user space function which has
> a fewer then the last user space function registers itself.
> Composite's set_config() function that a pointer after the
> last interface in usb_configuration::interface is NULL
> unless the array is full.

> This patch makes the __gfs_do_config() make sure that if the
> usb_configuration::interface is not full then a pointer
> after the last interface is NULL.

> Signed-off-by: Michal Nazarewicz <m.nazarewicz@...sung.com>
> Signed-off-by: Kyungmin Park <kyungmin.park@...sung.com>
> ---
>  drivers/usb/gadget/g_ffs.c |   11 +++++++++++
>  1 files changed, 11 insertions(+), 0 deletions(-)

> diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
> index 2f26470..da3a9e4 100644
> --- a/drivers/usb/gadget/g_ffs.c
> +++ b/drivers/usb/gadget/g_ffs.c
> @@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c,
>  	if (unlikely(ret < 0))
>  		return ret;
>  
> +	/* After previous do_configs there may be some invalid
> +	 * pointers in c->interface array.  This happens every time
> +	 * a user space function with fewer interfaces than a user
> +	 * space function that was run before the new one is run.  The
> +	 * compasit's set_config() assumes that if there is no more
> +	 * then MAX_CONFIG_INTERFACES interfaces in a configuration
> +	 * then there is a NULL pointer after the last interface in
> +	 * c->interface array.  We need to make sure this is true. */

    According to CodingStyle, the preferred style of the multi-line comments 
is this:

/*
  * bla
  * bla
  */

> +	if (c->next_interface_id < ARRAY_SIZE(c->interface))
> +		c->interface[c->next_interface_id] = NULL;
> +
>  	return 0;
>  }

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/