|
 |
c2763b5 |
From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
|
|
|
c2763b5 |
From: Oliver Neukum <oneukum@suse.com>
|
|
|
c2763b5 |
Date: Mon, 14 Mar 2016 15:53:38 +0100
|
|
|
12fb1ce |
Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports
|
|
|
c2763b5 |
|
|
|
c2763b5 |
The driver can be crashed with devices that expose crafted
|
|
|
c2763b5 |
descriptors with too few endpoints.
|
|
|
c2763b5 |
See:
|
|
|
c2763b5 |
http://seclists.org/bugtraq/2016/Mar/61
|
|
|
c2763b5 |
|
|
|
c2763b5 |
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
|
|
|
12fb1ce |
|
|
|
12fb1ce |
v1 - added sanity checks
|
|
|
12fb1ce |
v2 - moved them to probe() to fix problems Johan pointed out
|
|
|
c2763b5 |
---
|
|
|
12fb1ce |
drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++-----
|
|
|
12fb1ce |
1 file changed, 19 insertions(+), 5 deletions(-)
|
|
|
c2763b5 |
|
|
|
c2763b5 |
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
|
|
|
12fb1ce |
index 12b0e67..dab1dcf 100644
|
|
|
c2763b5 |
--- a/drivers/usb/serial/digi_acceleport.c
|
|
|
c2763b5 |
+++ b/drivers/usb/serial/digi_acceleport.c
|
|
|
12fb1ce |
@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
|
|
|
12fb1ce |
static int digi_startup(struct usb_serial *serial)
|
|
|
12fb1ce |
{
|
|
|
12fb1ce |
struct digi_serial *serial_priv;
|
|
|
12fb1ce |
- int ret;
|
|
|
12fb1ce |
+ int ret = -ENODEV;
|
|
|
12fb1ce |
+ int i;
|
|
|
12fb1ce |
|
|
|
12fb1ce |
serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
|
|
|
12fb1ce |
if (!serial_priv)
|
|
|
12fb1ce |
@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial)
|
|
|
c2763b5 |
|
|
|
c2763b5 |
spin_lock_init(&serial_priv->ds_serial_lock);
|
|
|
c2763b5 |
serial_priv->ds_oob_port_num = serial->type->num_ports;
|
|
|
12fb1ce |
+
|
|
|
12fb1ce |
+ /* Check whether the expected number of ports matches the device */
|
|
|
12fb1ce |
+ if (serial->num_ports < serial_priv->ds_oob_port_num)
|
|
|
12fb1ce |
+ goto error;
|
|
|
12fb1ce |
+ /* all features must be present */
|
|
|
12fb1ce |
+ for (i = 0; i < serial->type->num_ports + 1 ; i++) {
|
|
|
12fb1ce |
+ if (!serial->port[i]->read_urb)
|
|
|
12fb1ce |
+ goto error;
|
|
|
12fb1ce |
+ if (!serial->port[i]->write_urb)
|
|
|
12fb1ce |
+ goto error;
|
|
|
c2763b5 |
+ }
|
|
|
12fb1ce |
+
|
|
|
c2763b5 |
serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
|
|
|
c2763b5 |
|
|
|
c2763b5 |
ret = digi_port_init(serial_priv->ds_oob_port,
|
|
|
12fb1ce |
serial_priv->ds_oob_port_num);
|
|
|
12fb1ce |
- if (ret) {
|
|
|
12fb1ce |
- kfree(serial_priv);
|
|
|
12fb1ce |
- return ret;
|
|
|
12fb1ce |
- }
|
|
|
12fb1ce |
+ if (ret)
|
|
|
12fb1ce |
+ goto error;
|
|
|
12fb1ce |
|
|
|
12fb1ce |
usb_set_serial_data(serial, serial_priv);
|
|
|
12fb1ce |
|
|
|
12fb1ce |
return 0;
|
|
|
12fb1ce |
+error:
|
|
|
12fb1ce |
+ kfree(serial_priv);
|
|
|
12fb1ce |
+ return ret;
|
|
|
12fb1ce |
}
|
|
|
12fb1ce |
|
|
|
12fb1ce |
|
|
|
c2763b5 |
--
|
|
|
12fb1ce |
2.1.4
|