| Message ID | 1457964773-29512-1-git-send-email-jwboyer@fedoraproject.org (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
On Mon, Mar 14, 2016 at 10:12:53AM -0400, Josh Boyer wrote: > The powermate driver expects at least one valid USB endpoint in its > probe function. If given malicious descriptors that specify 0 for > the number of endpoints, it will crash. Validate the number of > endpoints on the interface before using them. > > The full report for this issue can be found here: > http://seclists.org/bugtraq/2016/Mar/85 > > Reported-by: Ralf Spenneberg <ralf@spenneberg.net> > Cc: stable <stable@vger.kernel.org> > Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> > --- > drivers/input/misc/powermate.c | 3 +++ > 1 file changed, 3 insertions(+) I'll queue these up after 4.6-rc1 is out as the merge window is closed right now, but we might want to think about a better way to handle this type of thing in the USB core. A way to keep from having to add checks like this for every single driver, when the driver shouldn't even really have their probe function called unless their expected endpoints are going to be there. I'll think about that over the next few weeks... thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Mar 14, 2016 at 09:15:48AM -0700, Greg Kroah-Hartman wrote: > On Mon, Mar 14, 2016 at 10:12:53AM -0400, Josh Boyer wrote: > > The powermate driver expects at least one valid USB endpoint in its > > probe function. If given malicious descriptors that specify 0 for > > the number of endpoints, it will crash. Validate the number of > > endpoints on the interface before using them. > > > > The full report for this issue can be found here: > > http://seclists.org/bugtraq/2016/Mar/85 > > > > Reported-by: Ralf Spenneberg <ralf@spenneberg.net> > > Cc: stable <stable@vger.kernel.org> > > Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> > > --- > > drivers/input/misc/powermate.c | 3 +++ > > 1 file changed, 3 insertions(+) > > I'll queue these up after 4.6-rc1 is out as the merge window is closed > right now, but we might want to think about a better way to handle this > type of thing in the USB core. A way to keep from having to add checks I do not see any reason in holding it until after rc1, applied. > like this for every single driver, when the driver shouldn't even really > have their probe function called unless their expected endpoints are > going to be there. I had a patch where driver could declare minimal amount of endpoints it expects to find, but you mentioned we need something more flexible... Thanks.
On Mon, Mar 14, 2016 at 12:15 PM, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > On Mon, Mar 14, 2016 at 10:12:53AM -0400, Josh Boyer wrote: >> The powermate driver expects at least one valid USB endpoint in its >> probe function. If given malicious descriptors that specify 0 for >> the number of endpoints, it will crash. Validate the number of >> endpoints on the interface before using them. >> >> The full report for this issue can be found here: >> http://seclists.org/bugtraq/2016/Mar/85 >> >> Reported-by: Ralf Spenneberg <ralf@spenneberg.net> >> Cc: stable <stable@vger.kernel.org> >> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> >> --- >> drivers/input/misc/powermate.c | 3 +++ >> 1 file changed, 3 insertions(+) > > I'll queue these up after 4.6-rc1 is out as the merge window is closed > right now, but we might want to think about a better way to handle this > type of thing in the USB core. A way to keep from having to add checks > like this for every single driver, when the driver shouldn't even really > have their probe function called unless their expected endpoints are > going to be there. I thought this discussion came up a while ago, when something very similar was fixed in the whiteheat driver (commit cbb4be652d374). I can't find the thread at the moment, but I thought someone said this had to be per-driver for some reason. I'm more than happy to have a core subsystem fix if it's possible. > I'll think about that over the next few weeks... I have something around 8 drivers with issues like this. I think Oliver (now CC'd) is working from the same set of bugs. Should we hold off on submitting individual fixes until later, or should we go ahead and submit them? josh -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Mar 14, 2016 at 9:46 AM, Josh Boyer <jwboyer@fedoraproject.org> wrote: > On Mon, Mar 14, 2016 at 12:15 PM, Greg Kroah-Hartman > <gregkh@linuxfoundation.org> wrote: >> On Mon, Mar 14, 2016 at 10:12:53AM -0400, Josh Boyer wrote: >>> The powermate driver expects at least one valid USB endpoint in its >>> probe function. If given malicious descriptors that specify 0 for >>> the number of endpoints, it will crash. Validate the number of >>> endpoints on the interface before using them. >>> >>> The full report for this issue can be found here: >>> http://seclists.org/bugtraq/2016/Mar/85 >>> >>> Reported-by: Ralf Spenneberg <ralf@spenneberg.net> >>> Cc: stable <stable@vger.kernel.org> >>> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> >>> --- >>> drivers/input/misc/powermate.c | 3 +++ >>> 1 file changed, 3 insertions(+) >> >> I'll queue these up after 4.6-rc1 is out as the merge window is closed >> right now, but we might want to think about a better way to handle this >> type of thing in the USB core. A way to keep from having to add checks >> like this for every single driver, when the driver shouldn't even really >> have their probe function called unless their expected endpoints are >> going to be there. > > I thought this discussion came up a while ago, when something very > similar was fixed in the whiteheat driver (commit cbb4be652d374). I > can't find the thread at the moment, but I thought someone said this > had to be per-driver for some reason. I'm more than happy to have a > core subsystem fix if it's possible. > >> I'll think about that over the next few weeks... > > I have something around 8 drivers with issues like this. I think > Oliver (now CC'd) is working from the same set of bugs. Should we > hold off on submitting individual fixes until later, or should we go > ahead and submit them? I'll take input bits, there is no need to keep kernel oopsing while we are working on a more general solution. Thanks.
On Mon, Mar 14, 2016 at 12:46:26PM -0400, Josh Boyer wrote: > On Mon, Mar 14, 2016 at 12:15 PM, Greg Kroah-Hartman > <gregkh@linuxfoundation.org> wrote: > > On Mon, Mar 14, 2016 at 10:12:53AM -0400, Josh Boyer wrote: > >> The powermate driver expects at least one valid USB endpoint in its > >> probe function. If given malicious descriptors that specify 0 for > >> the number of endpoints, it will crash. Validate the number of > >> endpoints on the interface before using them. > >> > >> The full report for this issue can be found here: > >> http://seclists.org/bugtraq/2016/Mar/85 > >> > >> Reported-by: Ralf Spenneberg <ralf@spenneberg.net> > >> Cc: stable <stable@vger.kernel.org> > >> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> > >> --- > >> drivers/input/misc/powermate.c | 3 +++ > >> 1 file changed, 3 insertions(+) > > > > I'll queue these up after 4.6-rc1 is out as the merge window is closed > > right now, but we might want to think about a better way to handle this > > type of thing in the USB core. A way to keep from having to add checks > > like this for every single driver, when the driver shouldn't even really > > have their probe function called unless their expected endpoints are > > going to be there. > > I thought this discussion came up a while ago, when something very > similar was fixed in the whiteheat driver (commit cbb4be652d374). I > can't find the thread at the moment, but I thought someone said this > had to be per-driver for some reason. I'm more than happy to have a > core subsystem fix if it's possible. > > > I'll think about that over the next few weeks... > > I have something around 8 drivers with issues like this. I think > Oliver (now CC'd) is working from the same set of bugs. Should we > hold off on submitting individual fixes until later, or should we go > ahead and submit them? Please submit them, that will give us a framework to be able to figure out the specifics of what needs to be changed. thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c index 63b539d3daba..84909a12ff36 100644 --- a/drivers/input/misc/powermate.c +++ b/drivers/input/misc/powermate.c @@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i int error = -ENOMEM; interface = intf->cur_altsetting; + if (interface->desc.bNumEndpoints < 1) + return -EINVAL; + endpoint = &interface->endpoint[0].desc; if (!usb_endpoint_is_int_in(endpoint)) return -EIO;
The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Cc: stable <stable@vger.kernel.org> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> --- drivers/input/misc/powermate.c | 3 +++ 1 file changed, 3 insertions(+)