lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 052/453] USB: serial: option: add interface-number sanity check to flag handling
    Date
    From: Johan Hovold <johan@kernel.org>

    commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.

    Add an interface-number sanity check before testing the device flags to
    avoid relying on undefined behaviour when left shifting in case a device
    uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
    or 32).

    Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
    Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
    Cc: stable@vger.kernel.org
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/option.c | 23 +++++++++++++++++++++--
    1 file changed, 21 insertions(+), 2 deletions(-)

    --- a/drivers/usb/serial/option.c
    +++ b/drivers/usb/serial/option.c
    @@ -563,6 +563,9 @@ static void option_instat_callback(struc

    /* Device flags */

    +/* Highest interface number which can be used with NCTRL() and RSVD() */
    +#define FLAG_IFNUM_MAX 7
    +
    /* Interface does not support modem-control requests */
    #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8)

    @@ -2101,6 +2104,14 @@ static struct usb_serial_driver * const

    module_usb_serial_driver(serial_drivers, option_ids);

    +static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
    +{
    + if (ifnum > FLAG_IFNUM_MAX)
    + return false;
    +
    + return device_flags & RSVD(ifnum);
    +}
    +
    static int option_probe(struct usb_serial *serial,
    const struct usb_device_id *id)
    {
    @@ -2117,7 +2128,7 @@ static int option_probe(struct usb_seria
    * the same class/subclass/protocol as the serial interfaces. Look at
    * the Windows driver .INF files for reserved interface numbers.
    */
    - if (device_flags & RSVD(iface_desc->bInterfaceNumber))
    + if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
    return -ENODEV;

    /*
    @@ -2133,6 +2144,14 @@ static int option_probe(struct usb_seria
    return 0;
    }

    +static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
    +{
    + if (ifnum > FLAG_IFNUM_MAX)
    + return false;
    +
    + return device_flags & NCTRL(ifnum);
    +}
    +
    static int option_attach(struct usb_serial *serial)
    {
    struct usb_interface_descriptor *iface_desc;
    @@ -2148,7 +2167,7 @@ static int option_attach(struct usb_seri

    iface_desc = &serial->interface->cur_altsetting->desc;

    - if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
    + if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
    data->use_send_setup = 1;

    if (device_flags & ZLP)

    \
     
     \ /
      Last update: 2020-12-28 16:53    [W:4.063 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site