| Message ID | 20180720123842.14540-2-colin.king@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | usb: usbtest: fix NULL pointer dereference | expand |
On 20.07.2018 14:38, Colin King wrote: > From: Alan Stern <stern@rowland.harvard.edu> > > CVE-2017-16532 > > If the usbtest driver encounters a device with an IN bulk endpoint but > no OUT bulk endpoint, it will try to dereference a NULL pointer > (out->desc.bEndpointAddress). The problem can be solved by adding a > missing test. > > Signed-off-by: Alan Stern <stern@rowland.harvard.edu> > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> > (upstream cherry pick of commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8) > Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- -> (cherry picked from commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8) > drivers/usb/misc/usbtest.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c > index 113e38b..b3fc602 100644 > --- a/drivers/usb/misc/usbtest.c > +++ b/drivers/usb/misc/usbtest.c > @@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) > return tmp; > } > > - if (in) { > + if (in) > dev->in_pipe = usb_rcvbulkpipe(udev, > in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); > + if (out) > dev->out_pipe = usb_sndbulkpipe(udev, > out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); > - } > + > if (iso_in) { > dev->iso_in = &iso_in->desc; > dev->in_iso_pipe = usb_rcvisocpipe(udev, >
On 07/20/18 14:38, Colin King wrote: > From: Alan Stern <stern@rowland.harvard.edu> > > CVE-2017-16532 > > If the usbtest driver encounters a device with an IN bulk endpoint but > no OUT bulk endpoint, it will try to dereference a NULL pointer > (out->desc.bEndpointAddress). The problem can be solved by adding a > missing test. > > Signed-off-by: Alan Stern <stern@rowland.harvard.edu> > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> > (upstream cherry pick of commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8) > Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> > --- > drivers/usb/misc/usbtest.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c > index 113e38b..b3fc602 100644 > --- a/drivers/usb/misc/usbtest.c > +++ b/drivers/usb/misc/usbtest.c > @@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) > return tmp; > } > > - if (in) { > + if (in) > dev->in_pipe = usb_rcvbulkpipe(udev, > in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); > + if (out) > dev->out_pipe = usb_sndbulkpipe(udev, > out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); > - } > + > if (iso_in) { > dev->iso_in = &iso_in->desc; > dev->in_iso_pipe = usb_rcvisocpipe(udev, >
Applied to trusty master-next. ...Juerg On 07/20/2018 02:38 PM, Colin King wrote: > From: Alan Stern <stern@rowland.harvard.edu> > > CVE-2017-16532 > > If the usbtest driver encounters a device with an IN bulk endpoint but > no OUT bulk endpoint, it will try to dereference a NULL pointer > (out->desc.bEndpointAddress). The problem can be solved by adding a > missing test. > > Signed-off-by: Alan Stern <stern@rowland.harvard.edu> > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> > (upstream cherry pick of commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8) > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/usb/misc/usbtest.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c > index 113e38b..b3fc602 100644 > --- a/drivers/usb/misc/usbtest.c > +++ b/drivers/usb/misc/usbtest.c > @@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) > return tmp; > } > > - if (in) { > + if (in) > dev->in_pipe = usb_rcvbulkpipe(udev, > in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); > + if (out) > dev->out_pipe = usb_sndbulkpipe(udev, > out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); > - } > + > if (iso_in) { > dev->iso_in = &iso_in->desc; > dev->in_iso_pipe = usb_rcvisocpipe(udev, >
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c index 113e38b..b3fc602 100644 --- a/drivers/usb/misc/usbtest.c +++ b/drivers/usb/misc/usbtest.c @@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) return tmp; } - if (in) { + if (in) dev->in_pipe = usb_rcvbulkpipe(udev, in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); + if (out) dev->out_pipe = usb_sndbulkpipe(udev, out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); - } + if (iso_in) { dev->iso_in = &iso_in->desc; dev->in_iso_pipe = usb_rcvisocpipe(udev,