* [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe
@ 2017-03-13 12:49 Johan Hovold
2017-03-13 13:42 ` Guenter Roeck
0 siblings, 1 reply; 4+ messages in thread
From: Johan Hovold @ 2017-03-13 12:49 UTC (permalink / raw)
To: Wim Van Sebroeck
Cc: Guenter Roeck, linux-watchdog, linux-kernel, Johan Hovold, stable
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/watchdog/pcwd_usb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
index 99ebf6ea3de6..5615f4013924 100644
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
return -ENODEV;
}
+ if (iface_desc->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
/* check out the endpoint: it has to be Interrupt & IN */
endpoint = &iface_desc->endpoint[0].desc;
--
2.12.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe
2017-03-13 12:49 [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe Johan Hovold
@ 2017-03-13 13:42 ` Guenter Roeck
2017-03-13 14:17 ` Johan Hovold
0 siblings, 1 reply; 4+ messages in thread
From: Guenter Roeck @ 2017-03-13 13:42 UTC (permalink / raw)
To: Johan Hovold, Wim Van Sebroeck; +Cc: linux-watchdog, linux-kernel, stable
On 03/13/2017 05:49 AM, Johan Hovold wrote:
> Make sure to check the number of endpoints to avoid dereferencing a
> NULL-pointer should a malicious device lack endpoints.
>
Is this theory or was it actually observed ?
Thanks,
Guenter
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable <stable@vger.kernel.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
> drivers/watchdog/pcwd_usb.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
> index 99ebf6ea3de6..5615f4013924 100644
> --- a/drivers/watchdog/pcwd_usb.c
> +++ b/drivers/watchdog/pcwd_usb.c
> @@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
> return -ENODEV;
> }
>
> + if (iface_desc->desc.bNumEndpoints < 1)
> + return -ENODEV;
> +
> /* check out the endpoint: it has to be Interrupt & IN */
> endpoint = &iface_desc->endpoint[0].desc;
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe
2017-03-13 13:42 ` Guenter Roeck
@ 2017-03-13 14:17 ` Johan Hovold
2017-03-13 17:15 ` Guenter Roeck
0 siblings, 1 reply; 4+ messages in thread
From: Johan Hovold @ 2017-03-13 14:17 UTC (permalink / raw)
To: Guenter Roeck
Cc: Johan Hovold, Wim Van Sebroeck, linux-watchdog, linux-kernel,
stable, linux-usb
[ Adding linux-usb which I forgot to CC for this one ]
On Mon, Mar 13, 2017 at 06:42:45AM -0700, Guenter Roeck wrote:
> On 03/13/2017 05:49 AM, Johan Hovold wrote:
> > Make sure to check the number of endpoints to avoid dereferencing a
> > NULL-pointer should a malicious device lack endpoints.
> >
>
> Is this theory or was it actually observed ?
This was found through inspection, but creating a USB device to crash a
host with this driver enabled is easily done.
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Cc: stable <stable@vger.kernel.org>
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> > ---
> > drivers/watchdog/pcwd_usb.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> > diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
> > index 99ebf6ea3de6..5615f4013924 100644
> > --- a/drivers/watchdog/pcwd_usb.c
> > +++ b/drivers/watchdog/pcwd_usb.c
> > @@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
> > return -ENODEV;
> > }
> >
> > + if (iface_desc->desc.bNumEndpoints < 1)
> > + return -ENODEV;
> > +
> > /* check out the endpoint: it has to be Interrupt & IN */
> > endpoint = &iface_desc->endpoint[0].desc;
> >
> >
Johan
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe
2017-03-13 14:17 ` Johan Hovold
@ 2017-03-13 17:15 ` Guenter Roeck
0 siblings, 0 replies; 4+ messages in thread
From: Guenter Roeck @ 2017-03-13 17:15 UTC (permalink / raw)
To: Johan Hovold
Cc: Wim Van Sebroeck, linux-watchdog, linux-kernel, stable, linux-usb
On Mon, Mar 13, 2017 at 03:17:39PM +0100, Johan Hovold wrote:
> [ Adding linux-usb which I forgot to CC for this one ]
>
> On Mon, Mar 13, 2017 at 06:42:45AM -0700, Guenter Roeck wrote:
> > On 03/13/2017 05:49 AM, Johan Hovold wrote:
> > > Make sure to check the number of endpoints to avoid dereferencing a
> > > NULL-pointer should a malicious device lack endpoints.
> > >
> >
> > Is this theory or was it actually observed ?
>
> This was found through inspection, but creating a USB device to crash a
> host with this driver enabled is easily done.
>
Ok, makes sense. I see other drivers doing a similar check.
Guenter
> > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > > Cc: stable <stable@vger.kernel.org>
> > > Signed-off-by: Johan Hovold <johan@kernel.org>
> > > ---
> > > drivers/watchdog/pcwd_usb.c | 3 +++
> > > 1 file changed, 3 insertions(+)
> > >
> > > diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
> > > index 99ebf6ea3de6..5615f4013924 100644
> > > --- a/drivers/watchdog/pcwd_usb.c
> > > +++ b/drivers/watchdog/pcwd_usb.c
> > > @@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
> > > return -ENODEV;
> > > }
> > >
> > > + if (iface_desc->desc.bNumEndpoints < 1)
> > > + return -ENODEV;
> > > +
> > > /* check out the endpoint: it has to be Interrupt & IN */
> > > endpoint = &iface_desc->endpoint[0].desc;
> > >
> > >
>
> Johan
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-03-13 17:15 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-13 12:49 [PATCH] watchdog: pcwd_usb: fix NULL-deref at probe Johan Hovold
2017-03-13 13:42 ` Guenter Roeck
2017-03-13 14:17 ` Johan Hovold
2017-03-13 17:15 ` Guenter Roeck
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox