linux-stable.git/drivers/usb/usbip, branch linux-4.15.y

usbip: vudc: fix null pointer dereference on udc->lock

2018-03-19T08:09:47+00:00

commit df3334c223a033f562645712e832ca4cbb326bbf upstream.

Currently the driver attempts to spin lock on udc->lock before a NULL
pointer check is performed on udc, hence there is a potential null
pointer dereference on udc->lock.  Fix this by moving the null check
on udc before the lock occurs.

Fixes: ea6873a45a22 ("usbip: vudc: Add SysFS infrastructure for VUDC")
Signed-off-by: Colin Ian King 
Acked-by: Shuah Khan 
Reviewed-by: Krzysztof Opasiak 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: keep usbip_device sockfd state in sync with tcp_socket

2018-02-25T10:15:43+00:00

commit 009f41aed4b3e11e6dc1e3c07377a10c20f1a5ed upstream.

Keep usbip_device sockfd state in sync with tcp_socket. When tcp_socket
is reset to null, reset sockfd to -1 to keep it in sync.

Signed-off-by: Shuah Khan 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer

2018-01-04T16:07:27+00:00

v_send_ret_submit() handles urb with a null transfer_buffer, when it
replays a packet with potential malicious data that could contain a
null buffer.

Add a check for the condition when actual_length > 0 and transfer_buffer
is null.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: remove kernel addresses from usb device and urb debug msgs

2018-01-04T16:07:26+00:00

usbip_dump_usb_device() and usbip_dump_urb() print kernel addresses.
Remove kernel addresses from usb device and urb debug msgs and improve
the message content.

Instead of printing parent device and bus addresses, print parent device
and bus names.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input

2018-01-04T16:07:26+00:00

Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: stub_rx: fix static checker warning on unnecessary checks

2017-12-19T10:40:55+00:00

Fix the following static checker warnings:

The patch c6688ef9f297: "usbip: fix stub_rx: harden CMD_SUBMIT path
to handle malicious input" from Dec 7, 2017, leads to the following
static checker warning:

    drivers/usb/usbip/stub_rx.c:346 get_pipe()
    warn: impossible condition
'(pdu->u.cmd_submit.transfer_buffer_length > ((~0 >> 1))) =>
(s32min-s32max > s32max)'
    drivers/usb/usbip/stub_rx.c:486 stub_recv_cmd_submit()
    warn: always true condition
'(pdu->u.cmd_submit.transfer_buffer_length <= ((~0 >> 1))) =>
(s32min-s32max <= s32max)'

Reported-by: Dan Carpenter 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

usbip: prevent leaking socket pointer address in messages

2017-12-19T10:40:54+00:00

usbip driver is leaking socket pointer address in messages. Remove
the messages that aren't useful and print sockfd in the ones that
are useful for debugging.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: stub: stop printing kernel pointer addresses in messages

2017-12-19T10:40:54+00:00

Remove and/or change debug, info. and error messages to not print
kernel pointer addresses.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: vhci: stop printing kernel pointer addresses in messages

2017-12-19T10:40:54+00:00

Remove and/or change debug, info. and error messages to not print
kernel pointer addresses.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer

2017-12-08T16:32:23+00:00

stub_send_ret_submit() handles urb with a potential null transfer_buffer,
when it replays a packet with potential malicious data that could contain
a null buffer. Add a check for the condition when actual_length > 0 and
transfer_buffer is null.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman