linux-kernel - [PATCH v3] usb: dwc2: Fix endpoint direction check in ep_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20210127103919.58215-1-heiko@sntech.de>
Date:   Wed, 27 Jan 2021 11:39:19 +0100
From:   Heiko Stuebner <heiko@...ech.de>
To:     hminas@...opsys.com, gregkh@...uxfoundation.org
Cc:     christoph.muellner@...obroma-systems.com, paulz@...opsys.com,
        yousaf.kaukab@...el.com, balbi@...com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, heiko@...ech.de,
        Heiko Stuebner <heiko.stuebner@...obroma-systems.com>,
        Gerhard Klostermeier <gerhard.klostermeier@...s.de>,
        stable@...r.kernel.org
Subject: [PATCH v3] usb: dwc2: Fix endpoint direction check in ep_from_windex

From: Heiko Stuebner <heiko.stuebner@...obroma-systems.com>

dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.

In a test-case with a rndis gadget running and sending a malformed
packet to it like:
    dev.ctrl_transfer(
        0x82,      # bmRequestType
        0x00,       # bRequest
        0x0000,     # wValue
        0x0001,     # wIndex
        0x00       # wLength
    )
it is possible to cause a crash:

[  217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[  217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[  218.313189] Call trace:
[  218.330217]  ep_from_windex+0x3c/0x54
[  218.348565]  usb_gadget_giveback_request+0x10/0x20
[  218.368056]  dwc2_hsotg_complete_request+0x144/0x184

This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.

The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.

Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Reported-by: Gerhard Klostermeier <gerhard.klostermeier@...s.de>
Signed-off-by: Heiko Stuebner <heiko.stuebner@...obroma-systems.com>
Cc: stable@...r.kernel.org
---
changes in v3:
- added Reported-by tag
changes in v2:
- remove unused struct dwc2_hsotg_ep *ep;

 drivers/usb/dwc2/gadget.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0a0d11151cfb..ad4c94366dad 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1543,7 +1543,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
 static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
 					    u32 windex)
 {
-	struct dwc2_hsotg_ep *ep;
 	int dir = (windex & USB_DIR_IN) ? 1 : 0;
 	int idx = windex & 0x7F;
 
@@ -1553,12 +1552,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
 	if (idx > hsotg->num_of_eps)
 		return NULL;
 
-	ep = index_to_ep(hsotg, idx, dir);
-
-	if (idx && ep->dir_in != dir)
-		return NULL;
-
-	return ep;
+	return index_to_ep(hsotg, idx, dir);
 }
 
 /**
-- 
2.29.2