linux-kernel - [PATCH] usb: core: Null deref in kernel with USB webcams.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAO5W59jOWuRKizngF8vv9jb-zr_HnLC2eNxKqi3AYwg8KLwKoA@mail.gmail.com>
Date:   Thu, 12 Nov 2020 15:52:02 +0000
From:   John Boero <boeroboy@...il.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Felipe Balbi <balbi@...nel.org>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] usb: core: Null deref in kernel with USB webcams.

>From 54f9886454e9a28e8d943c1cef15df9c11555df7 Mon Sep 17 00:00:00 2001
From: JohnnyB <jboero@...rs.noreply.github.com>
Date: Thu, 12 Nov 2020 15:28:29 +0000
Subject: [PATCH] usb: core: Null deref in kernel with USB webcams.

Fixes: Ubuntu Launchpad bug 1827452

This is my first attempt at a kernel contribution so sorry if sloppy.

There is some kind of race condition affecting Logitech
webcams that crash USB with a null dereference.
Affects raspberry pi devices as well as x86.
No check on dev before dereference.
Simple fix for issue experienced for months in
both x86 and arm/rpi environments.

Signed-off-by: John Boero <boeroboy@...il.com>

---
drivers/usb/core/usb.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index d8756ffe513a..9b4ac4415f1a 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -272,13 +272,9 @@ EXPORT_SYMBOL_GPL(usb_find_alt_setting);
struct usb_interface *usb_ifnum_to_if(const struct usb_device *dev,
                                     unsigned ifnum)
{
-       struct usb_host_config *config = NULL;
+       struct usb_host_config *config = dev->actconfig;
       int i;

-       if (!dev)
-               return NULL;
-
-       config = dev->actconfig;
       if (!config)
               return NULL;
       for (i = 0; i < config->desc.bNumInterfaces; i++)
--
2.26.2