linux-stable.git/drivers/usb/usbip, branch linux-4.1.y

usbip: vhci_hcd: Fix usb device and sockfd leaks

2018-05-23T01:36:37+00:00

[ Upstream commit 9020a7efe537856eb3e826ebebdf38a5d07a7857 ]

vhci_hcd fails to do reset to put usb device and sockfd in the
module remove/stop paths. Fix the leak.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: usbip_host: fix to hold parent lock for device_attach() calls

2018-05-23T01:36:37+00:00

[ Upstream commit 4bfb141bc01312a817d36627cc47c93f801c216d ]

usbip_host calls device_attach() without holding dev->parent lock.
Fix it.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: keep usbip_device sockfd state in sync with tcp_socket

2018-03-04T15:28:25+00:00

[ Upstream commit 009f41aed4b3e11e6dc1e3c07377a10c20f1a5ed ]

Keep usbip_device sockfd state in sync with tcp_socket. When tcp_socket
is reset to null, reset sockfd to -1 to keep it in sync.

Signed-off-by: Shuah Khan 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: prevent leaking socket pointer address in messages

2018-03-01T03:09:43+00:00

[ Upstream commit 90120d15f4c397272aaf41077960a157fc4212bf ]

usbip driver is leaking socket pointer address in messages. Remove
the messages that aren't useful and print sockfd in the ones that
are useful for debugging.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input

2018-03-01T03:09:43+00:00

[ Upstream commit c6688ef9f29762e65bce325ef4acd6c675806366 ]

Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations. Validate early in get_pipe() and return
failure.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: fix stub_rx: get_pipe() to validate endpoint number

2018-03-01T03:09:42+00:00

[ Upstream commit 635f545a7e8be7596b9b2b6a43cab6bbd5a88e43 ]

get_pipe() routine doesn't validate the input endpoint number
and uses to reference ep_in and ep_out arrays. Invalid endpoint
number can trigger BUG(). Range check the epnum and returning
error instead of calling BUG().

Change caller stub_recv_cmd_submit() to handle the get_pipe()
error return.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: prevent vhci_hcd driver from leaking a socket pointer address

2018-03-01T03:09:40+00:00

[ Upstream commit 2f2d0088eb93db5c649d2a5e34a3800a8a935fc5 ]

When a client has a USB device attached over IP, the vhci_hcd driver is
locally leaking a socket pointer address via the

/sys/devices/platform/vhci_hcd/status file (world-readable) and in debug
output when "usbip --debug port" is run.

Fix it to not leak. The socket pointer address is not used at the moment
and it was made visible as a convenient way to find IP address from socket
pointer address by looking up /proc/net/{tcp,tcp6}.

As this opens a security hole, the fix replaces socket pointer address with
sockfd.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: remove kernel addresses from usb device and urb debug msgs

2018-03-01T03:09:36+00:00

[ Upstream commit e1346fd87c71a1f61de1fe476ec8df1425ac931c ]

usbip_dump_usb_device() and usbip_dump_urb() print kernel addresses.
Remove kernel addresses from usb device and urb debug msgs and improve
the message content.

Instead of printing parent device and bus addresses, print parent device
and bus names.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: vhci: stop printing kernel pointer addresses in messages

2018-03-01T00:32:19+00:00

[ Upstream commit 8272d099d05f7ab2776cf56a2ab9f9443be18907 ]

Remove and/or change debug, info. and error messages to not print
kernel pointer addresses.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usbip: stub: stop printing kernel pointer addresses in messages

2018-03-01T00:32:18+00:00

[ Upstream commit 248a22044366f588d46754c54dfe29ffe4f8b4df ]

Remove and/or change debug, info. and error messages to not print
kernel pointer addresses.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin