From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55F1CC32750 for ; Fri, 2 Aug 2019 09:36:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2B3D0217F5 for ; Fri, 2 Aug 2019 09:36:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564738569; bh=Cd2/CtlMzi0MVSdMVDg8CkFE200fT4o/RHRtNoAlWUo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=srzAw9q3MXzf5oBOHqFgbzXYjwM0JYKxn2AL0lnVtTTAebic54+nYDZt6ZOZnVpNH rejXQ3JtKHy/hb4qTWQ9vD5T+GEy7c/kIUdWUukqm3kId7uCzKjigwQ1BTVvnKo+jC zWsBcZIp0P5//Tws/cdk6GSmd3z5hESMIgxw04Qc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404817AbfHBJgH (ORCPT ); Fri, 2 Aug 2019 05:36:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:36706 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2404102AbfHBJgB (ORCPT ); Fri, 2 Aug 2019 05:36:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 30BE3217D7; Fri, 2 Aug 2019 09:36:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564738560; bh=Cd2/CtlMzi0MVSdMVDg8CkFE200fT4o/RHRtNoAlWUo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iRAVGR9andUmREhK2pFrM9MHqUcjUfODbsv9LTlQzasUdYhKgVsA1knJ99gS8EkKM daV5Rt9FM2ykLmCsK6+GqrrjwFommgFw0o9bkCm7mbdVzFa3lkzfPc/YX+v6fbN2Gu h7N2uKYM0CujfoxaoLW7gWiq8q1eGggJNPAVUPv8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+8750abbc3a46ef47d509@syzkaller.appspotmail.com, Phong Tran , "David S. Miller" Subject: [PATCH 4.4 152/158] ISDN: hfcsusb: checking idx of ep configuration Date: Fri, 2 Aug 2019 11:29:33 +0200 Message-Id: <20190802092232.945909747@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190802092203.671944552@linuxfoundation.org> References: <20190802092203.671944552@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Phong Tran commit f384e62a82ba5d85408405fdd6aeff89354deaa9 upstream. The syzbot test with random endpoint address which made the idx is overflow in the table of endpoint configuations. this adds the checking for fixing the error report from syzbot KASAN: stack-out-of-bounds Read in hfcsusb_probe [1] The patch tested by syzbot [2] Reported-by: syzbot+8750abbc3a46ef47d509@syzkaller.appspotmail.com [1]: https://syzkaller.appspot.com/bug?id=30a04378dac680c5d521304a00a86156bb913522 [2]: https://groups.google.com/d/msg/syzkaller-bugs/_6HBdge8F3E/OJn7wVNpBAAJ Signed-off-by: Phong Tran Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/isdn/hardware/mISDN/hfcsusb.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/isdn/hardware/mISDN/hfcsusb.c +++ b/drivers/isdn/hardware/mISDN/hfcsusb.c @@ -1963,6 +1963,9 @@ hfcsusb_probe(struct usb_interface *intf /* get endpoint base */ idx = ((ep_addr & 0x7f) - 1) * 2; + if (idx > 15) + return -EIO; + if (ep_addr & 0x80) idx++; attr = ep->desc.bmAttributes;