queue-4.4/usb-core-fix-unterminated-string-returned-by-usb_string.patch

   1 From c01c348ecdc66085e44912c97368809612231520 Mon Sep 17 00:00:00 2001
   2 From: Alan Stern <stern@rowland.harvard.edu>
   3 Date: Mon, 15 Apr 2019 11:51:38 -0400
   4 Subject: USB: core: Fix unterminated string returned by usb_string()
   5
   6 From: Alan Stern <stern@rowland.harvard.edu>
   7
   8 commit c01c348ecdc66085e44912c97368809612231520 upstream.
   9
  10 Some drivers (such as the vub300 MMC driver) expect usb_string() to
  11 return a properly NUL-terminated string, even when an error occurs.
  12 (In fact, vub300's probe routine doesn't bother to check the return
  13 code from usb_string().)  When the driver goes on to use an
  14 unterminated string, it leads to kernel errors such as
  15 stack-out-of-bounds, as found by the syzkaller USB fuzzer.
  16
  17 An out-of-range string index argument is not at all unlikely, given
  18 that some devices don't provide string descriptors and therefore list
  19 0 as the value for their string indexes.  This patch makes
  20 usb_string() return a properly terminated empty string along with the
  21 -EINVAL error code when an out-of-range index is encountered.
  22
  23 And since a USB string index is a single-byte value, indexes >= 256
  24 are just as invalid as values of 0 or below.
  25
  26 Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
  27 Reported-by: syzbot+b75b85111c10b8d680f1@syzkaller.appspotmail.com
  28 CC: <stable@vger.kernel.org>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  drivers/usb/core/message.c |    4 +++-
  33  1 file changed, 3 insertions(+), 1 deletion(-)
  34
  35 --- a/drivers/usb/core/message.c
  36 +++ b/drivers/usb/core/message.c
  37 @@ -820,9 +820,11 @@ int usb_string(struct usb_device *dev, i
  38
  39         if (dev->state == USB_STATE_SUSPENDED)
  40                 return -EHOSTUNREACH;
  41 -       if (size <= 0 || !buf || !index)
  42 +       if (size <= 0 || !buf)
  43                 return -EINVAL;
  44         buf[0] = 0;
  45 +       if (index <= 0 || index >= 256)
  46 +               return -EINVAL;
  47         tbuf = kmalloc(256, GFP_NOIO);
  48         if (!tbuf)
  49                 return -ENOMEM;