linux-kernel - Re: [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 27 Jan 2021 11:40:14 +0100
From:   Heiko Stübner <heiko@...ech.de>
To:     hminas@...opsys.com, gregkh@...uxfoundation.org
Cc:     christoph.muellner@...obroma-systems.com, paulz@...opsys.com,
        yousaf.kaukab@...el.com, balbi@...com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from_windex

Am Mittwoch, 27. Januar 2021, 09:50:34 CET schrieb Heiko Stuebner:
> From: Heiko Stuebner <heiko.stuebner@...obroma-systems.com>
> 
> dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
> the endpoint for the index provided in the wIndex request param.
> 
> In a test-case with a rndis gadget running and sending a malformed
> packet to it like:
>     dev.ctrl_transfer(
>         0x82,      # bmRequestType
>         0x00,       # bRequest
>         0x0000,     # wValue
>         0x0001,     # wIndex
>         0x00       # wLength
>     )
> it is possible to cause a crash:
> 
> [  217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
> [  217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
> ...
> [  218.313189] Call trace:
> [  218.330217]  ep_from_windex+0x3c/0x54
> [  218.348565]  usb_gadget_giveback_request+0x10/0x20
> [  218.368056]  dwc2_hsotg_complete_request+0x144/0x184
> 
> This happens because ep_from_windex wants to compare the endpoint
> direction even if index_to_ep() didn't return an endpoint due to
> the direction not matching.
> 
> The fix is easy insofar that the actual direction check is already
> happening when calling index_to_ep() which will return NULL if there
> is no endpoint for the targeted direction, so the offending check
> can go away completely.
> 
> Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
> Signed-off-by: Heiko Stuebner <heiko.stuebner@...obroma-systems.com>
> Cc: stable@...r.kernel.org

superseeded by v3, which includes an appropriate Reported-by tag