kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/usbip
History
Ignat Korchagin 87cfd54498 USB: usbip: fix potential out-of-bounds write 
commit b348d7dddb upstream.

Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.

Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-05-01 00:06:11 +02:00
..
uapi staging/usbip: add uapi header to export usbip kernel interfaces 2014-03-04 16:12:14 -08:00
userspace USB driver patches for 3.16-rc1 2014-06-03 09:11:20 -07:00
Kconfig Kconfig: Remove useless "default N" lines 2014-02-20 14:38:06 +01:00
Makefile staging: usbip: edit Kconfig and rename CONFIG options 2011-05-12 09:17:57 -07:00
README staging: usbip: README: we need to document the protocol 2011-06-07 14:08:51 -07:00
stub.h staging: usbip: trigger driver probing after unbinding from usbip-host 2014-03-08 22:48:11 -08:00
stub_dev.c Staging: usbip: missing a blank lines after declarations 2014-05-24 01:59:36 +09:00
stub_main.c staging: usbip: trigger driver probing after unbinding from usbip-host 2014-03-08 22:48:11 -08:00
stub_rx.c staging: usbip: let client choose device configuration 2014-03-08 22:48:11 -08:00
stub_tx.c staging: usbip: use kcalloc instead of kzalloc for array allocations 2014-05-24 04:38:34 +09:00
usbip_common.c USB: usbip: fix potential out-of-bounds write 2016-05-01 00:06:11 +02:00
usbip_common.h Staging: usbip: missing a blank lines after declarations 2014-05-24 01:59:36 +09:00
usbip_event.c staging: usbip: Renaming pr_warning function 2013-05-13 13:39:31 -07:00
usbip_protocol.txt staging: Fix typo in multiple files 2012-04-10 10:31:01 -07:00
vhci.h staging: usbip: remove unnused, broken macro 2013-04-05 14:22:50 -07:00
vhci_hcd.c Staging: usbip: missing a blank lines after declarations 2014-05-24 01:59:36 +09:00
vhci_rx.c staging: usbip: removed enumeration of comments 2013-04-05 14:22:50 -07:00
vhci_sysfs.c staging/usbip: fix store_attach() sscanf return value check 2014-04-15 14:43:01 -07:00
vhci_tx.c staging: usbip: replace the interrupt safe spinlocks with common ones. 2013-01-22 09:00:10 -08:00

README 

TODO:
	- more discussion about the protocol
	- testing
	- review of the userspace interface
	- document the protocol

Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>