[PATCH 0/2] usb: gadget: f_tcm: validate command length before parsing

[Radhey Shyam Pandey]

f_tcm exposes a USB mass-storage target through configfs with two
alternate settings: Bulk-Only Transport (BOT, alt=0) and USB Attached
SCSI (UAS, alt=1).  In both paths the driver parses command buffers
received from the host without first ensuring that req->actual covers
every field read or copied.

This series validates the received length before parsing in each path.

Patch 1 (BOT): bot_submit_command() checked US_BULK_CB_WRAP_LEN only
after reading cbw->Signature.  A short host OUT transfer could read past
the received CBW buffer.  Check the length before accessing CBW
fields, matching f_mass_storage.c.

Patch 2 (UAS): usbg_submit_command() parsed Command and Task Management
IUs from a buffer sized to ep_cmd->maxpacket without checking
req->actual.  A host could supply a short IU or an inflated
cmd_iu->len and trigger an out-of-bounds read when copying the CDB.
Validate the received length before parsing and re-queue the command
endpoint request when validation fails.


Radhey Shyam Pandey (2):
  usb: gadget: f_tcm: validate CBW length before parsing
  usb: gadget: f_tcm: validate UAS command IU length before parsing

 drivers/usb/gadget/function/f_tcm.c | 42 ++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 12 deletions(-)


base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
-- 
2.44.4