lkml.org 
[lkml]   [2016]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: net/gadget: slab-out-of-bounds write in dev_config
Date

Hi,

Alan Stern <stern@rowland.harvard.edu> writes:
>> > Index: usb-4.x/drivers/usb/gadget/legacy/inode.c
>> > ===================================================================
>> > --- usb-4.x.orig/drivers/usb/gadget/legacy/inode.c
>> > +++ usb-4.x/drivers/usb/gadget/legacy/inode.c
>> > @@ -1126,7 +1126,7 @@ ep0_write (struct file *fd, const char _
>> > /* data and/or status stage for control request */
>> > } else if (dev->state == STATE_DEV_SETUP) {
>> >
>> > - /* IN DATA+STATUS caller makes len <= wLength */
>> > + len = min(len, (size_t) dev->setup_wLength);
>> > if (dev->setup_in) {
>> > retval = setup_req (dev->gadget->ep0, dev->req, len);
>> > if (retval == 0) {
>> >
>>
>> I already have a patch from Greg for this. See [1]
>>
>> [1] https://git.kernel.org/cgit/linux/kernel/git/balbi/usb.git/commit/?id=230bc0cb8ff222d9f0fbbd93a80393140b39481f
>
> The two patches fix different problems. My patch goes on the pathway
> where dev->state > STATE_DEV_OPENED in dev_config(), and Greg's patch
> handles the case where it is <=.

Okay, here's what I have so far in my testing/fixes:

$ git --no-pager shortlog testing/fixes ^linus/master
Alan Stern (5):
USB: dummy-hcd: fix bug in stop_activity (handle ep0)
USB: gadgetfs: fix unbounded memory allocation bug
USB: gadgetfs: fix use-after-free bug
USB: gadgetfs: fix checks of wTotalLength in config descriptors
USB: gadgetfs: remove unnecessary assignment

Baolin Wang (1):
usb: gadget: f_fs: Fix possibe deadlock

Felipe Balbi (4):
usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
usb: dwc3: gadget: always unmap EP0 requests
usb: dwc3: core: avoid Overflow events

Greg Kroah-Hartman (1):
usb: gadgetfs: restrict upper bound on device configuration size

Grygorii Strashko (1):
usb: dwc3: omap: fix race of pm runtime with irq handler in probe

Hans de Goede (1):
usb: dwc3: pci: Fix dr_mode misspelling

Heikki Krogerus (1):
usb: dwc3: pci: add Intel Gemini Lake PCI ID

Janusz Dziedzic (1):
usb: dwc3: skip interrupt when ep disabled

John Youn (1):
usb: dwc3: pci: Add "linux,sysdev_is_parent" property

Krzysztof Opasiak (1):
usb: gadget: composite: Test get_alt() presence instead of set_alt()

Marek Szyprowski (1):
usb: dwc2: fix flags for DMA descriptor allocation in dwc2_hsotg_ep_enable

Stefan Wahren (4):
usb: dwc2: Do not set host parameter in peripheral mode
usb: dwc2: fix dwc2_get_device_property for u8 and u16
usb: dwc2: fix default value for DMA support
usb: dwc2: gadget: fix default value for gadget-dma-desc

Vincent Pelletier (2):
usb: gadget: f_fs: Document eventfd effect on descriptor format.
usb: gadget: f_fs: Fix ExtCompat descriptor validation


--
balbi
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2016-12-28 12:54    [W:0.044 / U:0.624 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site