Thread (4 messages) flat view 4 messages, 1 author, 2019-12-02
STALE2471d LANDED

Revision v2 of 2 in this series; landed in mainline as 53f35a39c386 on 2019-12-10.

Revisions (2)
  1. v1 [diff vs current]
  2. v2 current

[PATCH v2 1/3] staging: gigaset: fix general protection fault on probe

From: Johan Hovold <johan@kernel.org>
Date: 2019-12-02 08:56:29
Also in: lkml, stable
Subsystem: staging subsystem, the rest · Maintainers: Greg Kroah-Hartman, Linus Torvalds

Fix a general protection fault when accessing the endpoint descriptors
which could be triggered by a malicious device due to missing sanity
checks on the number of endpoints.

Reported-by: syzbot+35b1c403a14f5c89eba7@syzkaller.appspotmail.com
Fixes: 07dc1f9f2f80 ("[PATCH] isdn4linux: Siemens Gigaset drivers - M105 USB DECT adapter")
Cc: stable <redacted>     # 2.6.17
Cc: Hansjoerg Lipp <redacted>
Cc: Tilman Schmidt <redacted>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/staging/isdn/gigaset/usb-gigaset.c | 5 +++++
 1 file changed, 5 insertions(+)
diff --git a/drivers/staging/isdn/gigaset/usb-gigaset.c b/drivers/staging/isdn/gigaset/usb-gigaset.c
index 1b9b43659bdf..5e393e7dde45 100644
--- a/drivers/staging/isdn/gigaset/usb-gigaset.c
+++ b/drivers/staging/isdn/gigaset/usb-gigaset.c
@@ -685,6 +685,11 @@ static int gigaset_probe(struct usb_interface *interface,
 		return -ENODEV;
 	}
 
+	if (hostif->desc.bNumEndpoints < 2) {
+		dev_err(&interface->dev, "missing endpoints\n");
+		return -ENODEV;
+	}
+
 	dev_info(&udev->dev, "%s: Device matched ... !\n", __func__);
 
 	/* allocate memory for our device state and initialize it */
-- 
2.24.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help