linux-kernel - Re: net/gadget: slab-out-of-bounds write in dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 28 Dec 2016 13:51:48 +0200
From:   Felipe Balbi <balbi@...nel.org>
To:     Alan Stern <stern@...land.harvard.edu>
Cc:     Andrey Konovalov <andreyknvl@...gle.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Marek Szyprowski <m.szyprowski@...sung.com>,
        David Sterba <dsterba@...e.com>,
        Ryusuke Konishi <konishi.ryusuke@....ntt.co.jp>,
        David Eccher <d.eccher@...il.com>, Bin Liu <b-liu@...com>,
        Mathieu Laurendeau <mat.lau@...oste.net>,
        Binyamin Sharet <s.binyamin@...il.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        linux-usb@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: net/gadget: slab-out-of-bounds write in dev_config


Hi,

Alan Stern <stern@...land.harvard.edu> writes:
>> > Index: usb-4.x/drivers/usb/gadget/legacy/inode.c
>> > ===================================================================
>> > --- usb-4.x.orig/drivers/usb/gadget/legacy/inode.c
>> > +++ usb-4.x/drivers/usb/gadget/legacy/inode.c
>> > @@ -1126,7 +1126,7 @@ ep0_write (struct file *fd, const char _
>> >  	/* data and/or status stage for control request */
>> >  	} else if (dev->state == STATE_DEV_SETUP) {
>> >  
>> > -		/* IN DATA+STATUS caller makes len <= wLength */
>> > +		len = min(len, (size_t) dev->setup_wLength);
>> >  		if (dev->setup_in) {
>> >  			retval = setup_req (dev->gadget->ep0, dev->req, len);
>> >  			if (retval == 0) {
>> >
>> 
>> I already have a patch from Greg for this. See [1]
>> 
>> [1] https://git.kernel.org/cgit/linux/kernel/git/balbi/usb.git/commit/?id=230bc0cb8ff222d9f0fbbd93a80393140b39481f
>
> The two patches fix different problems.  My patch goes on the pathway
> where dev->state > STATE_DEV_OPENED in dev_config(), and Greg's patch
> handles the case where it is <=.

Okay, here's what I have so far in my testing/fixes:

$ git --no-pager shortlog testing/fixes ^linus/master
Alan Stern (5):
      USB: dummy-hcd: fix bug in stop_activity (handle ep0)
      USB: gadgetfs: fix unbounded memory allocation bug
      USB: gadgetfs: fix use-after-free bug
      USB: gadgetfs: fix checks of wTotalLength in config descriptors
      USB: gadgetfs: remove unnecessary assignment

Baolin Wang (1):
      usb: gadget: f_fs: Fix possibe deadlock

Felipe Balbi (4):
      usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
      usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
      usb: dwc3: gadget: always unmap EP0 requests
      usb: dwc3: core: avoid Overflow events

Greg Kroah-Hartman (1):
      usb: gadgetfs: restrict upper bound on device configuration size

Grygorii Strashko (1):
      usb: dwc3: omap: fix race of pm runtime with irq handler in probe

Hans de Goede (1):
      usb: dwc3: pci: Fix dr_mode misspelling

Heikki Krogerus (1):
      usb: dwc3: pci: add Intel Gemini Lake PCI ID

Janusz Dziedzic (1):
      usb: dwc3: skip interrupt when ep disabled

John Youn (1):
      usb: dwc3: pci: Add "linux,sysdev_is_parent" property

Krzysztof Opasiak (1):
      usb: gadget: composite: Test get_alt() presence instead of set_alt()

Marek Szyprowski (1):
      usb: dwc2: fix flags for DMA descriptor allocation in dwc2_hsotg_ep_enable

Stefan Wahren (4):
      usb: dwc2: Do not set host parameter in peripheral mode
      usb: dwc2: fix dwc2_get_device_property for u8 and u16
      usb: dwc2: fix default value for DMA support
      usb: dwc2: gadget: fix default value for gadget-dma-desc

Vincent Pelletier (2):
      usb: gadget: f_fs: Document eventfd effect on descriptor format.
      usb: gadget: f_fs: Fix ExtCompat descriptor validation


-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)