USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
The function hso_probe reads if_num from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data. Add a length check for both locations and updated hso_probe to bail on error. This issue has been assigned CVE-2018-19985. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
ee28b30cbb
commit
5146f95df7
@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface)
|
|||||||
return -EIO;
|
return -EIO;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* check if we have a valid interface */
|
||||||
|
if (if_num > 16) {
|
||||||
|
kfree(config_data);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
switch (config_data[if_num]) {
|
switch (config_data[if_num]) {
|
||||||
case 0x0:
|
case 0x0:
|
||||||
result = 0;
|
result = 0;
|
||||||
@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface,
|
|||||||
|
|
||||||
/* Get the interface/port specification from either driver_info or from
|
/* Get the interface/port specification from either driver_info or from
|
||||||
* the device itself */
|
* the device itself */
|
||||||
if (id->driver_info)
|
if (id->driver_info) {
|
||||||
|
/* if_num is controlled by the device, driver_info is a 0 terminated
|
||||||
|
* array. Make sure, the access is in bounds! */
|
||||||
|
for (i = 0; i <= if_num; ++i)
|
||||||
|
if (((u32 *)(id->driver_info))[i] == 0)
|
||||||
|
goto exit;
|
||||||
port_spec = ((u32 *)(id->driver_info))[if_num];
|
port_spec = ((u32 *)(id->driver_info))[if_num];
|
||||||
else
|
} else {
|
||||||
port_spec = hso_get_config_data(interface);
|
port_spec = hso_get_config_data(interface);
|
||||||
|
if (port_spec < 0)
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
|
||||||
/* Check if we need to switch to alt interfaces prior to port
|
/* Check if we need to switch to alt interfaces prior to port
|
||||||
* configuration */
|
* configuration */
|
||||||
|
Loading…
Reference in New Issue
Block a user