lkml.org 
[lkml]   [2016]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 056/163] Input: gtco - fix crash on detecting device without endpoints
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Vladis Dronov <vdronov@redhat.com>

    commit 162f98dea487206d9ab79fc12ed64700667a894d upstream.

    The gtco driver expects at least one valid endpoint. If given malicious
    descriptors that specify 0 for the number of endpoints, it will crash in
    the probe function. Ensure there is at least one endpoint on the interface
    before using it.

    Also let's fix a minor coding style issue.

    The full correct report of this issue can be found in the public
    Red Hat Bugzilla:

    https://bugzilla.redhat.com/show_bug.cgi?id=1283385

    Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
    Signed-off-by: Vladis Dronov <vdronov@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/input/tablet/gtco.c | 10 +++++++++-
    1 file changed, 9 insertions(+), 1 deletion(-)

    --- a/drivers/input/tablet/gtco.c
    +++ b/drivers/input/tablet/gtco.c
    @@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interfa
    goto err_free_buf;
    }

    + /* Sanity check that a device has an endpoint */
    + if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
    + dev_err(&usbinterface->dev,
    + "Invalid number of endpoints\n");
    + error = -EINVAL;
    + goto err_free_urb;
    + }
    +
    /*
    * The endpoint is always altsetting 0, we know this since we know
    * this device only has one interrupt endpoint
    @@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interfa
    * HID report descriptor
    */
    if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
    - HID_DEVICE_TYPE, &hid_desc) != 0){
    + HID_DEVICE_TYPE, &hid_desc) != 0) {
    dev_err(&usbinterface->dev,
    "Can't retrieve exta USB descriptor to get hid report descriptor length\n");
    error = -EIO;

    \
     
     \ /
      Last update: 2016-05-03 02:41    [W:4.101 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site