linux-kernel - Re: [PATCH] media: usb: siano: Fix general protection fault in smsusb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 May 2019 08:01:08 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Alan Stern <stern@...land.harvard.edu>
Cc:     mchehab@...nel.org, andreyknvl@...gle.com,
        Kernel development list <linux-kernel@...r.kernel.org>,
        linux-media@...r.kernel.org, USB list <linux-usb@...r.kernel.org>,
        syzkaller-bugs@...glegroups.com, wen.yang99@....com.cn
Subject: Re: [PATCH] media: usb: siano: Fix general protection fault in smsusb

On Tue, May 07, 2019 at 12:39:47PM -0400, Alan Stern wrote:
> The syzkaller USB fuzzer found a general-protection-fault bug in the
> smsusb part of the Siano DVB driver.  The fault occurs during probe
> because the driver assumes without checking that the device has both
> IN and OUT endpoints and the IN endpoint is ep1.
> 
> By slightly rearranging the driver's initialization code, we can make
> the appropriate checks early on and thus avoid the problem.  If the
> expected endpoints aren't present, the new code safely returns -ENODEV
> from the probe routine.
> 
> Signed-off-by: Alan Stern <stern@...land.harvard.edu>
> Reported-and-tested-by: syzbot+53f029db71c19a47325a@...kaller.appspotmail.com
> CC: <stable@...r.kernel.org>

Reviewed-by: Johan Hovold <johan@...nel.org>