Commit 6817ae22 authored by James Forshaw's avatar James Forshaw Committed by Greg Kroah-Hartman

USB: whiteheat: Added bounds checking for bulk command response

This patch fixes a potential security issue in the whiteheat USB driver
which might allow a local attacker to cause kernel memory corrpution. This
is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
EHCI and XHCI busses it's possible to craft responses greater than 64
bytes leading a buffer overflow.
Signed-off-by: default avatarJames Forshaw <forshaw@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c3d3af52
...@@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb) ...@@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb)
dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__); dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
return; return;
} }
if (!urb->actual_length) {
dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
return;
}
if (status) { if (status) {
dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status); dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
if (status != -ENOENT) if (status != -ENOENT)
...@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb) ...@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb)
/* These are unsolicited reports from the firmware, hence no /* These are unsolicited reports from the firmware, hence no
waiting command to wakeup */ waiting command to wakeup */
dev_dbg(&urb->dev->dev, "%s - event received\n", __func__); dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
} else if (data[0] == WHITEHEAT_GET_DTR_RTS) { } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
(urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
memcpy(command_info->result_buffer, &data[1], memcpy(command_info->result_buffer, &data[1],
urb->actual_length - 1); urb->actual_length - 1);
command_info->command_finished = WHITEHEAT_CMD_COMPLETE; command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment