From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 012E6C352A1 for ; Sat, 3 Dec 2022 14:59:47 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 940DE8516C; Sat, 3 Dec 2022 15:59:45 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="HPDIygGf"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 1DF0A851DF; Sat, 3 Dec 2022 15:59:43 +0100 (CET) Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 9DDD7850EC for ; Sat, 3 Dec 2022 15:59:40 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=szymon.heidrich@gmail.com Received: by mail-lj1-x235.google.com with SMTP id z4so8534965ljq.6 for ; Sat, 03 Dec 2022 06:59:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=HV5BNEJmkOi6Obxe+Nolw2oNKFCabXyRW2HgM0jlT7w=; b=HPDIygGfDeHtiWpUsoKeSsY2i2i9MTHPwYeDInsOyWaT4GXWXJwvbA/JVrvBgiN+Kv T5A13sAtvBt1OdsBXL4OWLlIYfUk1KKlCnrYM1SHtyCw7Jl9RVbbiqq4l39lHRs50enS JJ7zmhI5G6s0PJ60Z8zQ9LhVDFXdISvKrO28v3bPc447Ue7GrfYbqdupWMWBoJL25ek9 FabfTVL9c41hJadcFovMorvU0JnUwNptgsSmmMZX9qRYsTkkIgXdaTnOsf4yF+zWC4UP Myi8PiOWWDe0w43HYlfqX4/H0v11jYNsAASxfiDcB1SSkdIJ/Z5epEf8mSwaSmo+e8vv jbhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=HV5BNEJmkOi6Obxe+Nolw2oNKFCabXyRW2HgM0jlT7w=; b=1P/ZXqDJ9RpmSjAW5aH1Ofbh2sn41aFFPX92A6HfyUeLNdQvaNGZE1liyaQb9KvNlt xnz22EWBPvkHctK+HMMBAY/VxGoAPon8gCm/jssK4ibSpYw7thbVlo/gW0RRrVlsDa/b OuFYQegA+hX2GD8vGvskSlApFFCacMC0dW6mRJhPUZzEgMoK0Z7iFcLQccDQm9caYhDr j9cqwr6+Le2Hl75xXZETRxnwjEwLnPR9PjdP4Nx3MIhYOVEyB/CPXLwgRsbjKqAKMiSL o6bbDQ1kC+lWA2VbKUFcwqQdV9LBvWHy48/hUw3XMUUPWjg6K3os3VvODMqV4/LTSewM 24lQ== X-Gm-Message-State: ANoB5pkXBB0MtbBaaG7EGjWKlb23oX5VBzIFWrI+OFL23q/ayUSF4L75 Og6U8QSxkwYYPj9josyZIKE= X-Google-Smtp-Source: AA0mqf4JDAacrVJEZrFnfk4DcBi5G1cJBG5HfUQZOF7ekG9QY8c7o8E7DWe9JGvRqqabyBa1axH0bQ== X-Received: by 2002:a05:651c:2205:b0:26e:33f:3c3c with SMTP id y5-20020a05651c220500b0026e033f3c3cmr24087031ljq.52.1670079579708; Sat, 03 Dec 2022 06:59:39 -0800 (PST) Received: from [192.168.50.20] (077222238151.warszawa.vectranet.pl. [77.222.238.151]) by smtp.gmail.com with ESMTPSA id r14-20020ac25f8e000000b004996fbfd75esm1418451lfe.71.2022.12.03.06.59.38 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 03 Dec 2022 06:59:39 -0800 (PST) Message-ID: <0625e391-ce84-20be-e89e-94f4e961c44c@gmail.com> Date: Sat, 3 Dec 2022 15:59:37 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.5.1 Subject: Re: [PATCH] Enforce buffer boundaries on RNDIS USB Gadget To: Fabio Estevam , Lukasz Majewski , Marek Vasut Cc: u-boot@lists.denx.de References: <20221117194438.67015-1-szymon.heidrich@gmail.com> Content-Language: en-US From: Szymon Heidrich In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean On 20/11/2022 16:02, Fabio Estevam wrote: > Szymon, > > On Thu, Nov 17, 2022 at 4:46 PM Szymon Heidrich > wrote: >> >> Prevent access to arbitrary memory locations in gen_ndis_set_resp >> via manipulation of buf->InformationBufferOffset. Lack of validation >> of BufOffset could be exploited to dump arbitrary memory contents >> via NDIS packet filter. >> >> Signed-off-by: Szymon Heidrich > > Please run ./scripts/get_maintainer.pl on your patch and copy the maintainers. > Hello Fabio, Sorry I missed adding Lukasz and Marek - I'll keep that in mind for future. Is there anything else missing from my side? Best regards, Szymon > >> --- >> drivers/usb/gadget/rndis.c | 9 ++++++--- >> 1 file changed, 6 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c >> index 13c327ea38..3948f2cc9a 100644 >> --- a/drivers/usb/gadget/rndis.c >> +++ b/drivers/usb/gadget/rndis.c >> @@ -855,14 +855,17 @@ static int rndis_set_response(int configNr, rndis_set_msg_type *buf) >> rndis_set_cmplt_type *resp; >> rndis_resp_t *r; >> >> + BufLength = get_unaligned_le32(&buf->InformationBufferLength); >> + BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); >> + if ((BufOffset > RNDIS_MAX_TOTAL_SIZE - 8) || >> + (BufLength > RNDIS_MAX_TOTAL_SIZE - 8 - BufOffset)) >> + return -EINVAL; >> + >> r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type)); >> if (!r) >> return -ENOMEM; >> resp = (rndis_set_cmplt_type *) r->buf; >> >> - BufLength = get_unaligned_le32(&buf->InformationBufferLength); >> - BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); >> - >> #ifdef VERBOSE >> debug("%s: Length: %d\n", __func__, BufLength); >> debug("%s: Offset: %d\n", __func__, BufOffset); >> -- >> 2.38.1 >>