linux-kernel - [PATCH] usb: gadget/composite : Avoid crash with bad gadget drivers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri,  9 Aug 2013 21:23:08 +0300
From:	Philippe De Swert <philippe.deswert@...lamobile.com>
To:	linux-usb@...r.kernel.org, gregkh@...uxfoundation.org,
	balbi@...com, linux-kernel@...r.kernel.org
Cc:	Philippe De Swert <philippe.deswert@...lamobile.com>
Subject: [PATCH] usb: gadget/composite : Avoid crash with bad gadget drivers

Some bad gadget drivers do not check the return status of usb_add_config.
Thus they get a not correctly initialized config and when this gadget gets
deactivated the whole kernel crashes. Since on initialization failure cdev
is set to NULL it can be used to detect this problem situation. It can be
argued that the faulty gadget driver should be fixed, but imho it is better
to avoid crashing the kernel and letting the gadget developer know he/she
is making a mistake. And have the developer of said gadget driver then fix
the problem of course.

Signed-off-by: Philippe De Swert <philippe.deswert@...lamobile.com>
---
 drivers/usb/gadget/composite.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 55f4df6..e019bb5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -848,12 +848,18 @@ void usb_remove_config(struct usb_composite_dev *cdev,
 {
 	unsigned long flags;
 
+	if (config->cdev == NULL) {
+		pr_warn("Calling usb_remove_config without a matching usb_add_config!\n");
+		goto end;
+	}
+
 	spin_lock_irqsave(&cdev->lock, flags);
 
 	if (cdev->config == config)
 		reset_config(cdev);
 
 	spin_unlock_irqrestore(&cdev->lock, flags);
+end:
 
 	remove_config(cdev, config);
 }
-- 
1.8.1.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/