]>
Commit | Line | Data |
---|---|---|
addb52d6 GKH |
1 | From 5fd77a3a0e408c23ab4002a57db980e46bc16e72 Mon Sep 17 00:00:00 2001 |
2 | From: Shuah Khan <shuahkh@osg.samsung.com> | |
3 | Date: Fri, 22 Dec 2017 19:23:47 -0700 | |
4 | Subject: usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer | |
5 | ||
6 | From: Shuah Khan <shuahkh@osg.samsung.com> | |
7 | ||
8 | commit 5fd77a3a0e408c23ab4002a57db980e46bc16e72 upstream. | |
9 | ||
10 | v_send_ret_submit() handles urb with a null transfer_buffer, when it | |
11 | replays a packet with potential malicious data that could contain a | |
12 | null buffer. | |
13 | ||
14 | Add a check for the condition when actual_length > 0 and transfer_buffer | |
15 | is null. | |
16 | ||
17 | Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com> | |
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
19 | ||
20 | --- | |
21 | drivers/usb/usbip/vudc_tx.c | 11 +++++++++-- | |
22 | 1 file changed, 9 insertions(+), 2 deletions(-) | |
23 | ||
24 | --- a/drivers/usb/usbip/vudc_tx.c | |
25 | +++ b/drivers/usb/usbip/vudc_tx.c | |
26 | @@ -97,6 +97,13 @@ static int v_send_ret_submit(struct vudc | |
27 | memset(&pdu_header, 0, sizeof(pdu_header)); | |
28 | memset(&msg, 0, sizeof(msg)); | |
29 | ||
30 | + if (urb->actual_length > 0 && !urb->transfer_buffer) { | |
31 | + dev_err(&udc->gadget.dev, | |
32 | + "urb: actual_length %d transfer_buffer null\n", | |
33 | + urb->actual_length); | |
34 | + return -1; | |
35 | + } | |
36 | + | |
37 | if (urb_p->type == USB_ENDPOINT_XFER_ISOC) | |
38 | iovnum = 2 + urb->number_of_packets; | |
39 | else | |
40 | @@ -112,8 +119,8 @@ static int v_send_ret_submit(struct vudc | |
41 | ||
42 | /* 1. setup usbip_header */ | |
43 | setup_ret_submit_pdu(&pdu_header, urb_p); | |
44 | - usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n", | |
45 | - pdu_header.base.seqnum, urb); | |
46 | + usbip_dbg_stub_tx("setup txdata seqnum: %d\n", | |
47 | + pdu_header.base.seqnum); | |
48 | usbip_header_correct_endian(&pdu_header, 1); | |
49 | ||
50 | iov[iovnum].iov_base = &pdu_header; |