linux.git/drivers/usb/usbip, branch v4.15

usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer

2018-01-04T16:07:27+00:00

v_send_ret_submit() handles urb with a null transfer_buffer, when it
replays a packet with potential malicious data that could contain a
null buffer.

Add a check for the condition when actual_length > 0 and transfer_buffer
is null.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: remove kernel addresses from usb device and urb debug msgs

2018-01-04T16:07:26+00:00

usbip_dump_usb_device() and usbip_dump_urb() print kernel addresses.
Remove kernel addresses from usb device and urb debug msgs and improve
the message content.

Instead of printing parent device and bus addresses, print parent device
and bus names.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input

2018-01-04T16:07:26+00:00

Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: stub_rx: fix static checker warning on unnecessary checks

2017-12-19T10:40:55+00:00

Fix the following static checker warnings:

The patch c6688ef9f297: "usbip: fix stub_rx: harden CMD_SUBMIT path
to handle malicious input" from Dec 7, 2017, leads to the following
static checker warning:

    drivers/usb/usbip/stub_rx.c:346 get_pipe()
    warn: impossible condition
'(pdu->u.cmd_submit.transfer_buffer_length > ((~0 >> 1))) =>
(s32min-s32max > s32max)'
    drivers/usb/usbip/stub_rx.c:486 stub_recv_cmd_submit()
    warn: always true condition
'(pdu->u.cmd_submit.transfer_buffer_length <= ((~0 >> 1))) =>
(s32min-s32max <= s32max)'

Reported-by: Dan Carpenter 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

usbip: prevent leaking socket pointer address in messages

2017-12-19T10:40:54+00:00

usbip driver is leaking socket pointer address in messages. Remove
the messages that aren't useful and print sockfd in the ones that
are useful for debugging.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: stub: stop printing kernel pointer addresses in messages

2017-12-19T10:40:54+00:00

Remove and/or change debug, info. and error messages to not print
kernel pointer addresses.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: vhci: stop printing kernel pointer addresses in messages

2017-12-19T10:40:54+00:00

Remove and/or change debug, info. and error messages to not print
kernel pointer addresses.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer

2017-12-08T16:32:23+00:00

stub_send_ret_submit() handles urb with a potential null transfer_buffer,
when it replays a packet with potential malicious data that could contain
a null buffer. Add a check for the condition when actual_length > 0 and
transfer_buffer is null.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

usbip: prevent vhci_hcd driver from leaking a socket pointer address

2017-12-08T16:32:23+00:00

When a client has a USB device attached over IP, the vhci_hcd driver is
locally leaking a socket pointer address via the

/sys/devices/platform/vhci_hcd/status file (world-readable) and in debug
output when "usbip --debug port" is run.

Fix it to not leak. The socket pointer address is not used at the moment
and it was made visible as a convenient way to find IP address from socket
pointer address by looking up /proc/net/{tcp,tcp6}.

As this opens a security hole, the fix replaces socket pointer address with
sockfd.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input

2017-12-08T16:32:23+00:00

Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations. Validate early in get_pipe() and return
failure.

Reported-by: Secunia Research 
Cc: stable 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman