1
0
Fork 0
alistair23-linux/drivers/usb
Quentin Casasnovas 0d3bba0287 cdc-acm: prevent infinite loop when parsing CDC headers.
Phil and I found out a problem with commit:

  7e860a6e7a ("cdc-acm: add sanity checks")

It added some sanity checks to ignore potential garbage in CDC headers but
also introduced a potential infinite loop.  This can happen at the first
loop iteration (elength = 0 in that case) if the description isn't a
DT_CS_INTERFACE or later if 'buffer[0]' is zero.

It should also be noted that the wrong length was being added to 'buffer'
in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was
assigned after that check in the loop.

A specially crafted USB device could be used to trigger this infinite loop.

Fixes: 7e860a6e7a ("cdc-acm: add sanity checks")
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
CC: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
CC: Oliver Neukum <oneukum@suse.de>
CC: Adam Lee <adam8157@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-04-28 12:53:16 +02:00
..
atm ueagle-atm: Delete unnecessary checks before the function call "release_firmware" 2015-03-18 16:56:40 +01:00
c67x00 c67x00-hcd: use USB_DT_HUB 2015-04-03 19:03:16 +02:00
chipidea usb: chipidea: otg: remove mutex unlock and lock while stop and start role 2015-04-28 12:51:30 +02:00
class cdc-acm: prevent infinite loop when parsing CDC headers. 2015-04-28 12:53:16 +02:00
common usb: common: otg-fsm: only signal connect after switching to peripheral 2015-03-19 11:28:15 -05:00
core drivers/usb/core: devio.c: Removed an uneeded space before tab 2015-04-10 14:00:22 +02:00
dwc2 usb: dwc2: host: sleep USB_RESUME_TIMEOUT during resume 2015-04-10 13:52:49 +02:00
dwc3 usb: dwc3: make LPM configurable in DT 2015-03-10 15:33:33 -05:00
early
gadget Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
host Revert "usb: host: ehci-msm: Use devm_ioremap_resource instead of devm_ioremap" 2015-04-28 12:51:30 +02:00
image USB: image: use msecs_to_jiffies for time conversion 2015-03-18 16:20:34 +01:00
isp1760 usb: generic resume timeout for v4.1 2015-04-10 13:45:27 +02:00
misc usb/misc: fix chaoskey build, needs HW_RANDOM 2015-04-03 19:03:15 +02:00
mon
musb usb: generic resume timeout for v4.1 2015-04-10 13:45:27 +02:00
phy USB patches for 4.1-rc1 2015-04-13 17:07:21 -07:00
renesas_usbhs renesas_usbhs: mod_host: use USB_DT_HUB 2015-04-03 19:03:16 +02:00
serial Merge 4.0-rc7 into usb-next 2015-04-07 11:17:34 +02:00
storage uas: Set max_sectors_240 quirk for ASM1053 devices 2015-04-28 12:48:57 +02:00
usbip usbip: vhci_hcd: use USB_DT_HUB 2015-04-03 19:03:15 +02:00
wusbcore wusbcore: rh: use USB_DT_HUB 2015-04-03 19:03:15 +02:00
Kconfig usb: isp1760: Move driver from drivers/usb/host/ to drivers/usb/isp1760/ 2015-01-27 09:39:38 -06:00
Makefile usb: load usb phy earlier 2015-03-18 17:25:16 +01:00
README usb: hub: rename khubd to hub_wq in documentation and comments 2014-09-23 22:33:19 -07:00
usb-skeleton.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00

README

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.