From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753317AbdCMRPP (ORCPT ); Mon, 13 Mar 2017 13:15:15 -0400 Received: from bh-25.webhostbox.net ([208.91.199.152]:46195 "EHLO bh-25.webhostbox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752513AbdCMRPM (ORCPT ); Mon, 13 Mar 2017 13:15:12 -0400 Date: Mon, 13 Mar 2017 10:15:04 -0700 From: Guenter Roeck To: Johan Hovold Cc: Wim Van Sebroeck , linux-watchdog@vger.kernel.org, linux-kernel@vger.kernel.org, stable , linux-usb@vger.kernel.org Subject: Re: [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe Message-ID: <20170313171504.GA16813@roeck-us.net> References: <20170313124945.28923-1-johan@kernel.org> <20170313141739.GS4211@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170313141739.GS4211@localhost> User-Agent: Mutt/1.5.24 (2015-08-30) X-Authenticated_sender: guenter@roeck-us.net X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - bh-25.webhostbox.net X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - roeck-us.net X-Get-Message-Sender-Via: bh-25.webhostbox.net: authenticated_id: guenter@roeck-us.net X-Authenticated-Sender: bh-25.webhostbox.net: guenter@roeck-us.net X-Source: X-Source-Args: X-Source-Dir: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Mar 13, 2017 at 03:17:39PM +0100, Johan Hovold wrote: > [ Adding linux-usb which I forgot to CC for this one ] > > On Mon, Mar 13, 2017 at 06:42:45AM -0700, Guenter Roeck wrote: > > On 03/13/2017 05:49 AM, Johan Hovold wrote: > > > Make sure to check the number of endpoints to avoid dereferencing a > > > NULL-pointer should a malicious device lack endpoints. > > > > > > > Is this theory or was it actually observed ? > > This was found through inspection, but creating a USB device to crash a > host with this driver enabled is easily done. > Ok, makes sense. I see other drivers doing a similar check. Guenter > > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > > > Cc: stable > > > Signed-off-by: Johan Hovold > > > --- > > > drivers/watchdog/pcwd_usb.c | 3 +++ > > > 1 file changed, 3 insertions(+) > > > > > > diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c > > > index 99ebf6ea3de6..5615f4013924 100644 > > > --- a/drivers/watchdog/pcwd_usb.c > > > +++ b/drivers/watchdog/pcwd_usb.c > > > @@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface, > > > return -ENODEV; > > > } > > > > > > + if (iface_desc->desc.bNumEndpoints < 1) > > > + return -ENODEV; > > > + > > > /* check out the endpoint: it has to be Interrupt & IN */ > > > endpoint = &iface_desc->endpoint[0].desc; > > > > > > > > Johan