From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759658AbcCDQQY (ORCPT ); Fri, 4 Mar 2016 11:16:24 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:60572 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759443AbcCDQCc (ORCPT ); Fri, 4 Mar 2016 11:02:32 -0500 Message-Id: <20160304153000.798108133@1wt.eu> User-Agent: quilt/0.63-1 Date: Fri, 04 Mar 2016 16:30:02 +0100 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Oliver Neukum , Vladis Dronov , Hans Verkuil , Mauro Carvalho Chehab , Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 02/55] usbvision fix overflow of interfaces array MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <148ee355b419e9976ca727513a1405c8@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Neukum commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream. This fixes the crash reported in: http://seclists.org/bugtraq/2015/Oct/35 The interface number needs a sanity check. Signed-off-by: Oliver Neukum Cc: Vladis Dronov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 2.6.32: adjust filename, context] Signed-off-by: Ben Hutchings Signed-off-by: Willy Tarreau --- drivers/media/video/usbvision/usbvision-video.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/video/usbvision/usbvision-video.c b/drivers/media/video/usbvision/usbvision-video.c index a2a50d6..1ebe22b1 100644 --- a/drivers/media/video/usbvision/usbvision-video.c +++ b/drivers/media/video/usbvision/usbvision-video.c @@ -1651,6 +1651,13 @@ static int __devinit usbvision_probe(struct usb_interface *intf, printk(KERN_INFO "%s: %s found\n", __func__, usbvision_device_data[model].ModelString); + /* + * this is a security check. + * an exploit using an incorrect bInterfaceNumber is known + */ + if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) + return -ENODEV; + if (usbvision_device_data[model].Interface >= 0) { interface = &dev->actconfig->interface[usbvision_device_data[model].Interface]->altsetting[0]; } else { -- 1.7.12.2.21.g234cd45.dirty