]> git.ipfire.org Git - people/arne_f/kernel.git/commit
usb: core: fix slab-out-of-bounds Read in read_descriptors
authorZeng Tao <prime.zeng@hisilicon.com>
Fri, 4 Sep 2020 06:37:44 +0000 (14:37 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 23 Sep 2020 08:46:32 +0000 (10:46 +0200)
commite94f445c951917e44d011c7b3380d443a4822c66
tree95bb3260827403e1a97d0bdd4f747f7bf7ffe71c
parent92ded53bd998fb56c36280fa25239b491d66a423
usb: core: fix slab-out-of-bounds Read in read_descriptors

commit a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 upstream.

The USB device descriptor may get changed between two consecutive
enumerations on the same device for some reason, such as DFU or
malicius device.
In that case, we may access the changing descriptor if we don't take
the device lock here.

The issue is reported:
https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9

Cc: stable <stable@vger.kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/sysfs.c