Greg Kroah-Hartman
a6d4ce2e8b
USB: fix out-of-bounds in usb_set_configuration ...
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.
Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor. He writes:
It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
descriptor. It's only checked that the size is >= 2 in
usb_parse_configuration(), so find_iad() might do out-of-bounds access
to intf_assoc->bInterfaceCount.
And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem. Yet another issue found by syzkaller...
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-12 11:51:17 +02:00
usb: core: buffer: avoid NULL pointer dereferrence
2016-04-28 12:35:36 -07:00
USB: fix out-of-bounds in usb_set_configuration
2017-10-12 11:51:17 +02:00
usb: core: rename mutex usb_bus_list_lock to usb_bus_idr_lock
2016-02-06 21:55:57 -08:00
USB: devio: Don't corrupt user memory
2017-10-12 11:51:17 +02:00
usb: hub: Do not attempt to autosuspend disconnected devices
2017-05-20 14:28:36 +02:00
usb: endpoint: convert spaces to tabs
2015-08-14 16:50:36 -07:00
USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
2017-05-20 14:28:34 +02:00
staging: usbip: convert usbip-host driver to usb_device_driver
2014-02-07 10:54:30 -08:00
usb: hcd: out of bounds access in for_each_companion
2016-04-13 12:06:18 -07:00
usb: core: unlink urbs from the tail of the endpoint's urb_list
2017-08-16 13:43:21 -07:00
usb: Increase quirk delay for USB devices
2017-10-12 11:51:17 +02:00
usb: Support USB 3.1 extended port status request
2016-01-24 20:16:52 -08:00
usb: core: Introduce a USB port LED trigger
2016-09-27 12:20:17 +02:00
usb: core: usbport: Use proper LED API to fix potential crash
2017-01-06 10:40:11 +01:00
usb: core: Introduce a USB port LED trigger
2016-09-27 12:20:17 +02:00
USB: core: harden cdc_parse_cdc_header
2017-10-12 11:51:17 +02:00
usb: core: of.c: fix defined but not declare warning
2016-08-09 16:16:13 +02:00
usb: core: use IS_ENABLED() instead of checking for built-in or module
2016-09-02 14:36:33 +02:00
Revert "USB / PM: Allow USB devices to remain runtime-suspended when sleeping"
2016-05-02 08:44:31 -07:00
usb: Add device quirk for Logitech HD Pro Webcam C920-C
2017-09-09 17:39:36 +02:00
usb: no locking for reading descriptors in sysfs
2016-02-03 13:29:12 -08:00
USB: core: replace %p with %pK
2017-05-25 15:44:30 +02:00
usb: optimize acpi companion search for usb port devices
2017-08-24 17:12:21 -07:00
USB: core: fix device node leak
2017-07-12 15:01:03 +02:00
usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices
2016-01-24 20:16:52 -08:00
a6d4ce2e8b