kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/usbip
History
Malte Leip 2d399f685b usb: usbip: fix isoc packet num validation in get_pipe 
commit c409ca3be3 upstream.

Change the validation of number_of_packets in get_pipe to compare the
number of packets to a fixed maximum number of packets allowed, set to
be 1024. This number was chosen due to it being used by other drivers as
well, for example drivers/usb/host/uhci-q.c

Background/reason:
The get_pipe function in stub_rx.c validates the number of packets in
isochronous mode and aborts with an error if that number is too large,
in order to prevent malicious input from possibly triggering large
memory allocations. This was previously done by checking whether
pdu->u.cmd_submit.number_of_packets is bigger than the number of packets
that would be needed for pdu->u.cmd_submit.transfer_buffer_length bytes
if all except possibly the last packet had maximum length, given by
usb_endpoint_maxp(epd) *  usb_endpoint_maxp_mult(epd). This leads to an
error if URBs with packets shorter than the maximum possible length are
submitted, which is allowed according to
Documentation/driver-api/usb/URB.rst and occurs for example with the
snd-usb-audio driver.

Fixes: c6688ef9f2 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input")
Signed-off-by: Malte Leip <malte@leip.net>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust filenames]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-08-13 12:39:16 +01:00
..
uapi staging/usbip: add uapi header to export usbip kernel interfaces 2014-03-04 16:12:14 -08:00
userspace usbip: list: don't list devices attached to vhci_hcd 2018-06-16 22:21:58 +01:00
Kconfig Kconfig: Remove useless "default N" lines 2014-02-20 14:38:06 +01:00
Makefile staging: usbip: edit Kconfig and rename CONFIG options 2011-05-12 09:17:57 -07:00
README staging: usbip: README: we need to document the protocol 2011-06-07 14:08:51 -07:00
stub.h usbip: usbip_host: fix NULL-ptr deref and use-after-free errors 2018-09-25 23:47:23 +01:00
stub_dev.c usbip: usbip_host: fix NULL-ptr deref and use-after-free errors 2018-09-25 23:47:23 +01:00
stub_main.c usbip: usbip_host: fix bad unlock balance during stub_probe() 2018-09-25 23:47:23 +01:00
stub_rx.c usb: usbip: fix isoc packet num validation in get_pipe 2019-08-13 12:39:16 +01:00
stub_tx.c usbip: stub: stop printing kernel pointer addresses in messages 2018-03-03 15:52:02 +00:00
usbip_common.c usbip: remove kernel addresses from usb device and urb debug msgs 2018-03-03 15:52:11 +00:00
usbip_common.h usb: usbip: fix isoc packet num validation in get_pipe 2019-08-13 12:39:16 +01:00
usbip_event.c staging: usbip: Renaming pr_warning function 2013-05-13 13:39:31 -07:00
usbip_protocol.txt staging: Fix typo in multiple files 2012-04-10 10:31:01 -07:00
vhci.h staging: usbip: remove unnused, broken macro 2013-04-05 14:22:50 -07:00
vhci_hcd.c usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() 2018-12-16 22:09:39 +00:00
vhci_rx.c usbip: vhci: stop printing kernel pointer addresses in messages 2018-03-03 15:52:02 +00:00
vhci_sysfs.c usbip: prevent vhci_hcd driver from leaking a socket pointer address 2018-02-13 18:42:32 +00:00
vhci_tx.c usbip: vhci: stop printing kernel pointer addresses in messages 2018-03-03 15:52:02 +00:00

README 

TODO:
	- more discussion about the protocol
	- testing
	- review of the userspace interface
	- document the protocol

Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>