Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b78d830f authored by Shuah Khan's avatar Shuah Khan Committed by Greg Kroah-Hartman
Browse files

usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input 



Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations.

Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 30a7acd5

drivers/usb/usbip/vudc_rx.c

+19 −0
Original line number Diff line number Diff line
@@ -120,6 +120,25 @@ static int v_recv_cmd_submit(struct vudc *udc, 
	urb_p->new = 1;

	urb_p->seqnum = pdu->base.seqnum;



	if (urb_p->ep->type == USB_ENDPOINT_XFER_ISOC) {

		/* validate packet size and number of packets */

		unsigned int maxp, packets, bytes;



		maxp = usb_endpoint_maxp(urb_p->ep->desc);

		maxp *= usb_endpoint_maxp_mult(urb_p->ep->desc);

		bytes = pdu->u.cmd_submit.transfer_buffer_length;

		packets = DIV_ROUND_UP(bytes, maxp);



		if (pdu->u.cmd_submit.number_of_packets < 0 ||

		    pdu->u.cmd_submit.number_of_packets > packets) {

			dev_err(&udc->gadget.dev,

				"CMD_SUBMIT: isoc invalid num packets %d\n",

				pdu->u.cmd_submit.number_of_packets);

			ret = -EMSGSIZE;

			goto free_urbp;

		}

	}



	ret = alloc_urb_from_cmd(&urb_p->urb, pdu, urb_p->ep->type);

	if (ret) {

		usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_MALLOC);