Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 98db87df authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

USB: serial: visor: handle potential invalid device configuration 



commit 4842ed5bfcb9daf6660537d70503c18d38dbdbb8 upstream.

If we get an invalid device configuration from a palm 3 type device, we
might incorrectly parse things, and we have the potential to crash in
"interesting" ways.

Fix this up by verifying the size of the configuration passed to us by
the device, and only if it is correct, will we handle it.

Note that this also fixes an information leak of slab data.

Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Reviewed-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
[ johan: add comment about the info leak ]
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 613ac788

drivers/usb/serial/visor.c

+35 −34
Original line number Diff line number Diff line
@@ -338,14 +338,25 @@ static int palm_os_3_probe(struct usb_serial *serial, 
		goto exit;

	}



	if (retval == sizeof(*connection_info)) {

			connection_info = (struct visor_connection_info *)

							transfer_buffer;

	if (retval != sizeof(*connection_info)) {

		dev_err(dev, "Invalid connection information received from device\n");

		retval = -ENODEV;

		goto exit;

	}



	connection_info = (struct visor_connection_info *)transfer_buffer;



	num_ports = le16_to_cpu(connection_info->num_ports);



	/* Handle devices that report invalid stuff here. */

	if (num_ports == 0 || num_ports > 2) {

		dev_warn(dev, "%s: No valid connect info available\n",

			serial->type->description);

		num_ports = 2;

	}



	for (i = 0; i < num_ports; ++i) {

			switch (

			   connection_info->connections[i].port_function_id) {

		switch (connection_info->connections[i].port_function_id) {

		case VISOR_FUNCTION_GENERIC:

			string = "Generic";

			break;
@@ -369,16 +380,6 @@ static int palm_os_3_probe(struct usb_serial *serial, 
			serial->type->description,

			connection_info->connections[i].port, string);

	}

	}

	/*

	* Handle devices that report invalid stuff here.

	*/

	if (num_ports == 0 || num_ports > 2) {

		dev_warn(dev, "%s: No valid connect info available\n",

			serial->type->description);

		num_ports = 2;

	}



	dev_info(dev, "%s: Number of ports: %d\n", serial->type->description,

		num_ports);