kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/usbip
History
Shuah Khan (Samsung OSG) 0f30fad9f6 usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() 
commit 81f7567c51 upstream.

vhci_hub_control() accesses port_status array with out of bounds port
value. Fix it to reference port_status[] only with a valid rhport value
when invalid_rhport flag is true.

The invalid_rhport flag is set early on after detecting in port value
is within the bounds or not.

The following is used reproduce the problem and verify the fix:
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14ed8ab6400000

Reported-by: syzbot+bccc1fe10b70fadc78d0@syzkaller.appspotmail.com
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16:
 - s/VHCI_HC_PORTS/VHCI_NPORTS/
 - Mask wIndex before using it, as done upstream in commit 1c9de5bf42
   "usbip: vhci-hcd: Add USB3 SuperSpeed support"
 - Drop inapplicable changes
 - Adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-12-16 22:09:39 +00:00
..
uapi staging/usbip: add uapi header to export usbip kernel interfaces 2014-03-04 16:12:14 -08:00
userspace usbip: list: don't list devices attached to vhci_hcd 2018-06-16 22:21:58 +01:00
Kconfig Kconfig: Remove useless "default N" lines 2014-02-20 14:38:06 +01:00
Makefile staging: usbip: edit Kconfig and rename CONFIG options 2011-05-12 09:17:57 -07:00
README staging: usbip: README: we need to document the protocol 2011-06-07 14:08:51 -07:00
stub.h usbip: usbip_host: fix NULL-ptr deref and use-after-free errors 2018-09-25 23:47:23 +01:00
stub_dev.c usbip: usbip_host: fix NULL-ptr deref and use-after-free errors 2018-09-25 23:47:23 +01:00
stub_main.c usbip: usbip_host: fix bad unlock balance during stub_probe() 2018-09-25 23:47:23 +01:00
stub_rx.c usbip: stub_rx: fix static checker warning on unnecessary checks 2018-11-20 18:06:00 +00:00
stub_tx.c usbip: stub: stop printing kernel pointer addresses in messages 2018-03-03 15:52:02 +00:00
usbip_common.c usbip: remove kernel addresses from usb device and urb debug msgs 2018-03-03 15:52:11 +00:00
usbip_common.h usbip: vhci_hcd: Fix usb device and sockfd leaks 2018-10-21 08:45:35 +01:00
usbip_event.c staging: usbip: Renaming pr_warning function 2013-05-13 13:39:31 -07:00
usbip_protocol.txt staging: Fix typo in multiple files 2012-04-10 10:31:01 -07:00
vhci.h staging: usbip: remove unnused, broken macro 2013-04-05 14:22:50 -07:00
vhci_hcd.c usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() 2018-12-16 22:09:39 +00:00
vhci_rx.c usbip: vhci: stop printing kernel pointer addresses in messages 2018-03-03 15:52:02 +00:00
vhci_sysfs.c usbip: prevent vhci_hcd driver from leaking a socket pointer address 2018-02-13 18:42:32 +00:00
vhci_tx.c usbip: vhci: stop printing kernel pointer addresses in messages 2018-03-03 15:52:02 +00:00

README 

TODO:
	- more discussion about the protocol
	- testing
	- review of the userspace interface
	- document the protocol

Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>