From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga04.intel.com ([192.55.52.120]:51959 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753435AbcCYDDL (ORCPT ); Thu, 24 Mar 2016 23:03:11 -0400 Subject: Re: [PATCH 02/10] USB: cdc-acm: more sanity checking Cc: Oliver Neukum , stable@vger.kernel.org References: <1458874746-958-1-git-send-email-baolu.lu@linux.intel.com> <1458874746-958-2-git-send-email-baolu.lu@linux.intel.com> From: Lu Baolu Message-ID: <56F4AA6B.7050807@linux.intel.com> Date: Fri, 25 Mar 2016 11:03:07 +0800 MIME-Version: 1.0 In-Reply-To: <1458874746-958-2-git-send-email-baolu.lu@linux.intel.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit To: unlisted-recipients:; (no To-header on input) Sender: stable-owner@vger.kernel.org List-ID: I am sorry. This email was sent out due to an incorrect operation. Please ignore it. I am sorry for disturbing you. Best regards, Baolu On 03/25/2016 10:58 AM, Lu Baolu wrote: > From: Oliver Neukum > > An attack has become available which pretends to be a quirky > device circumventing normal sanity checks and crashes the kernel > by an insufficient number of interfaces. This patch adds a check > to the code path for quirky devices. > > Signed-off-by: Oliver Neukum > CC: stable@vger.kernel.org > Signed-off-by: Greg Kroah-Hartman > --- > drivers/usb/class/cdc-acm.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c > index 1d2c99a..83fd30b 100644 > --- a/drivers/usb/class/cdc-acm.c > +++ b/drivers/usb/class/cdc-acm.c > @@ -1179,6 +1179,9 @@ static int acm_probe(struct usb_interface *intf, > if (quirks == NO_UNION_NORMAL) { > data_interface = usb_ifnum_to_if(usb_dev, 1); > control_interface = usb_ifnum_to_if(usb_dev, 0); > + /* we would crash */ > + if (!data_interface || !control_interface) > + return -ENODEV; > goto skip_normal_probe; > } >