releases/4.7.7/usb-misc-legousbtower-fix-null-pointer-deference.patch

   1 From 2fae9e5a7babada041e2e161699ade2447a01989 Mon Sep 17 00:00:00 2001
   2 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   3 Date: Mon, 19 Sep 2016 19:09:51 +0100
   4 Subject: usb: misc: legousbtower: Fix NULL pointer deference
   5
   6 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   7
   8 commit 2fae9e5a7babada041e2e161699ade2447a01989 upstream.
   9
  10 This patch fixes a NULL pointer dereference caused by a race codition in
  11 the probe function of the legousbtower driver. It re-structures the
  12 probe function to only register the interface after successfully reading
  13 the board's firmware ID.
  14
  15 The probe function does not deregister the usb interface after an error
  16 receiving the devices firmware ID. The device file registered
  17 (/dev/usb/legousbtower%d) may be read/written globally before the probe
  18 function returns. When tower_delete is called in the probe function
  19 (after an r/w has been initiated), core dev structures are deleted while
  20 the file operation functions are still running. If the 0 address is
  21 mappable on the machine, this vulnerability can be used to create a
  22 Local Priviege Escalation exploit via a write-what-where condition by
  23 remapping dev->interrupt_out_buffer in tower_write. A forged USB device
  24 and local program execution would be required for LPE. The USB device
  25 would have to delay the control message in tower_probe and accept
  26 the control urb in tower_open whilst guest code initiated a write to the
  27 device file as tower_delete is called from the error in tower_probe.
  28
  29 This bug has existed since 2003. Patch tested by emulated device.
  30
  31 Reported-by: James Patrick-Evans <james@jmp-e.com>
  32 Tested-by: James Patrick-Evans <james@jmp-e.com>
  33 Signed-off-by: James Patrick-Evans <james@jmp-e.com>
  34 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  35
  36 ---
  37  drivers/usb/misc/legousbtower.c |   35 +++++++++++++++++------------------
  38  1 file changed, 17 insertions(+), 18 deletions(-)
  39
  40 --- a/drivers/usb/misc/legousbtower.c
  41 +++ b/drivers/usb/misc/legousbtower.c
  42 @@ -898,24 +898,6 @@ static int tower_probe (struct usb_inter
  43         dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
  44         dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
  45
  46 -       /* we can register the device now, as it is ready */
  47 -       usb_set_intfdata (interface, dev);
  48 -
  49 -       retval = usb_register_dev (interface, &tower_class);
  50 -
  51 -       if (retval) {
  52 -               /* something prevented us from registering this driver */
  53 -               dev_err(idev, "Not able to get a minor for this device.\n");
  54 -               usb_set_intfdata (interface, NULL);
  55 -               goto error;
  56 -       }
  57 -       dev->minor = interface->minor;
  58 -
  59 -       /* let the user know what node this device is now attached to */
  60 -       dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
  61 -                "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
  62 -                USB_MAJOR, dev->minor);
  63 -
  64         /* get the firmware version and log it */
  65         result = usb_control_msg (udev,
  66                                   usb_rcvctrlpipe(udev, 0),
  67 @@ -936,6 +918,23 @@ static int tower_probe (struct usb_inter
  68                  get_version_reply.minor,
  69                  le16_to_cpu(get_version_reply.build_no));
  70
  71 +       /* we can register the device now, as it is ready */
  72 +       usb_set_intfdata (interface, dev);
  73 +
  74 +       retval = usb_register_dev (interface, &tower_class);
  75 +
  76 +       if (retval) {
  77 +               /* something prevented us from registering this driver */
  78 +               dev_err(idev, "Not able to get a minor for this device.\n");
  79 +               usb_set_intfdata (interface, NULL);
  80 +               goto error;
  81 +       }
  82 +       dev->minor = interface->minor;
  83 +
  84 +       /* let the user know what node this device is now attached to */
  85 +       dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
  86 +                "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
  87 +                USB_MAJOR, dev->minor);
  88
  89  exit:
  90         return retval;