Re: net/gadget: slab-out-of-bounds write in dev_config

[Felipe Balbi]

Hi,

Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> writes:
>> > Index: usb-4.x/drivers/usb/gadget/legacy/inode.c
>> > ===================================================================
>> > --- usb-4.x.orig/drivers/usb/gadget/legacy/inode.c
>> > +++ usb-4.x/drivers/usb/gadget/legacy/inode.c
>> > @@ -1126,7 +1126,7 @@ ep0_write (struct file *fd, const char _
>> >  	/* data and/or status stage for control request */
>> >  	} else if (dev->state == STATE_DEV_SETUP) {
>> >  
>> > -		/* IN DATA+STATUS caller makes len <= wLength */
>> > +		len = min(len, (size_t) dev->setup_wLength);
>> >  		if (dev->setup_in) {
>> >  			retval = setup_req (dev->gadget->ep0, dev->req, len);
>> >  			if (retval == 0) {
>> >
>> 
>> I already have a patch from Greg for this. See [1]
>> 
>> [1] https://git.kernel.org/cgit/linux/kernel/git/balbi/usb.git/commit/?id=230bc0cb8ff222d9f0fbbd93a80393140b39481f
>
> The two patches fix different problems.  My patch goes on the pathway
> where dev->state > STATE_DEV_OPENED in dev_config(), and Greg's patch
> handles the case where it is <=.

Okay, here's what I have so far in my testing/fixes:

$ git --no-pager shortlog testing/fixes ^linus/master
Alan Stern (5):
      USB: dummy-hcd: fix bug in stop_activity (handle ep0)
      USB: gadgetfs: fix unbounded memory allocation bug
      USB: gadgetfs: fix use-after-free bug
      USB: gadgetfs: fix checks of wTotalLength in config descriptors
      USB: gadgetfs: remove unnecessary assignment

Baolin Wang (1):
      usb: gadget: f_fs: Fix possibe deadlock

Felipe Balbi (4):
      usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
      usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
      usb: dwc3: gadget: always unmap EP0 requests
      usb: dwc3: core: avoid Overflow events

Greg Kroah-Hartman (1):
      usb: gadgetfs: restrict upper bound on device configuration size

Grygorii Strashko (1):
      usb: dwc3: omap: fix race of pm runtime with irq handler in probe

Hans de Goede (1):
      usb: dwc3: pci: Fix dr_mode misspelling

Heikki Krogerus (1):
      usb: dwc3: pci: add Intel Gemini Lake PCI ID

Janusz Dziedzic (1):
      usb: dwc3: skip interrupt when ep disabled

John Youn (1):
      usb: dwc3: pci: Add "linux,sysdev_is_parent" property

Krzysztof Opasiak (1):
      usb: gadget: composite: Test get_alt() presence instead of set_alt()

Marek Szyprowski (1):
      usb: dwc2: fix flags for DMA descriptor allocation in dwc2_hsotg_ep_enable

Stefan Wahren (4):
      usb: dwc2: Do not set host parameter in peripheral mode
      usb: dwc2: fix dwc2_get_device_property for u8 and u16
      usb: dwc2: fix default value for DMA support
      usb: dwc2: gadget: fix default value for gadget-dma-desc

Vincent Pelletier (2):
      usb: gadget: f_fs: Document eventfd effect on descriptor format.
      usb: gadget: f_fs: Fix ExtCompat descriptor validation


-- 
balbi

Attachment: signature.asc
Description: PGP signature