lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZynmPkv8wXNRjUQS@kuha.fi.intel.com>
Date: Tue, 5 Nov 2024 11:32:46 +0200
From: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Ajay Gupta <ajayg@...dia.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Dmitry Baryshkov <dmitry.baryshkov@...aro.org>,
	Uwe Kleine-König <u.kleine-koenig@...libre.com>,
	Haotien Hsu <haotienh@...dia.com>, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] usb: typec: fix potential out of bounds in
 ucsi_ccg_update_set_new_cam_cmd()

On Mon, Nov 04, 2024 at 08:16:42PM +0300, Dan Carpenter wrote:
> The "*cmd" variable can be controlled by the user via debugfs.  That means
> "new_cam" can be as high as 255 while the size of the uc->updated[] array
> is UCSI_MAX_ALTMODES (30).
> 
> The call tree is:
> ucsi_cmd() // val comes from simple_attr_write_xsigned()
> -> ucsi_send_command()
>    -> ucsi_send_command_common()
>       -> ucsi_run_command() // calls ucsi->ops->sync_control()
>          -> ucsi_ccg_sync_control()
> 
> Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>

Reviewed-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>

> ---
>  drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
> index ba58d11907bc..bccfc03b5986 100644
> --- a/drivers/usb/typec/ucsi/ucsi_ccg.c
> +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
> @@ -482,6 +482,8 @@ static void ucsi_ccg_update_set_new_cam_cmd(struct ucsi_ccg *uc,
>  
>  	port = uc->orig;
>  	new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd);
> +	if (new_cam >= ARRAY_SIZE(uc->updated))
> +		return;
>  	new_port = &uc->updated[new_cam];
>  	cam = new_port->linked_idx;
>  	enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd);
> -- 
> 2.45.2

-- 
heikki

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ