usbip: vhci_hcd: Check rhport everywhere in vhci_hub_control()
From: Ben Hutchings <hidden>
Date: 2018-10-11 05:30:57
Subsystem:
the rest, usb over ip driver, usb subsystem · Maintainers:
Linus Torvalds, Valentina Manea, Shuah Khan, Shuah Khan, Greg Kroah-Hartman
Commit 5b22f676118f "usbip: vhci_hcd: check rhport before using in
vhci_hub_control()" added some validation of rhport, but left
several problems:
- If VHCI_HC_PORTS < 256, we can get rhport >= VHCI_HC_PORTS which
is also out of range. To keep things simple, set rhport to -1 if
this would happen.
- For GetPortStatus, we range-check wIndex (and by implication
rhport) and report an error, but *don't* skip the following code.
Add a goto to the error path.
- At the end of the function, there's one last port_status lookup
that's not protected by any range check.
Fixes: 5b22f676118f ("usbip: vhci_hcd: check rhport before using in ...")
Cc: stable@vger.kernel.org
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/usbip/vhci_hcd.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index d11f3f8dad40..e259d3812641 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c@@ -334,9 +334,12 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, usbip_dbg_vhci_rh("typeReq %x wValue %x wIndex %x\n", typeReq, wValue, wIndex); - if (wIndex > VHCI_HC_PORTS) + if (wIndex > VHCI_HC_PORTS) { pr_err("invalid port number %d\n", wIndex); - rhport = wIndex - 1; + rhport = -1; + } else { + rhport = wIndex - 1; + } vhci_hcd = hcd_to_vhci_hcd(hcd); vhci = vhci_hcd->vhci;
@@ -414,10 +417,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, *(__le32 *) buf = cpu_to_le32(0); break; case GetPortStatus: - usbip_dbg_vhci_rh(" GetPortStatus port %x\n", wIndex); - if (wIndex < 1) { - pr_err("invalid port number %d\n", wIndex); - retval = -EPIPE; + usbip_dbg_vhci_rh(" GetPortStatus port %x\n", rhport); + if (rhport < 0) { + pr_err("invalid port number %d\n", rhport); + goto error; } /* we do not care about resume. */
@@ -618,7 +621,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, spin_unlock_irqrestore(&vhci->lock, flags); - if ((vhci_hcd->port_status[rhport] & PORT_C_MASK) != 0) + if (rhport >= 0 && (vhci_hcd->port_status[rhport] & PORT_C_MASK) != 0) usb_hcd_poll_rh_status(hcd); return retval;