Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f46e7e6 authored by Badhri Jagan Sridharan's avatar Badhri Jagan Sridharan Committed by Dmitry Shmidt
Browse files

UPSTREAM: USB: usb_driver_claim_interface: add sanity checking 



commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.

Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

BUG: 28242610

Signed-off-by: default avatarOliver Neukum <ONeukum@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarBadhri Jagan Sridharan <Badhri@google.com>
Change-Id: Ib43ec5edb156985a9db941785a313f6801df092a
parent 093a852a

drivers/usb/core/driver.c

+5 −1
Original line number Diff line number Diff line
@@ -516,11 +516,15 @@ static int usb_unbind_interface(struct device *dev) 
int usb_driver_claim_interface(struct usb_driver *driver,

				struct usb_interface *iface, void *priv)

{

	struct device *dev = &iface->dev;

	struct device *dev;

	struct usb_device *udev;

	int retval = 0;

	int lpm_disable_error;



	if (!iface)

		return -ENODEV;



	dev = &iface->dev;

	if (dev->driver)

		return -EBUSY;