| Message ID | 20211025114532.4599-2-johan@kernel.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | comedi: misc fixes | expand |
On 25/10/2021 12:45, Johan Hovold wrote: > The driver uses endpoint-sized USB transfer buffers but had no sanity > checks on the sizes. This can lead to zero-size-pointer dereferences or > overflowed transfer buffers in ni6501_port_command() and > ni6501_counter_command() if a (malicious) device has smaller max-packet > sizes than expected (or when doing descriptor fuzz testing). > > Add the missing sanity checks to probe(). > > Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support") > Cc: stable@vger.kernel.org # 3.18 > Cc: Luca Ellero <luca.ellero@brickedbrain.com> > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > drivers/comedi/drivers/ni_usb6501.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/comedi/drivers/ni_usb6501.c b/drivers/comedi/drivers/ni_usb6501.c > index 5b6d9d783b2f..eb2e5c23f25d 100644 > --- a/drivers/comedi/drivers/ni_usb6501.c > +++ b/drivers/comedi/drivers/ni_usb6501.c > @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, > 0x00, 0x00, 0x00, 0x02, > 0x00, 0x00, 0x00, 0x00}; > > +/* Largest supported packets */ > +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); > +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); > + > enum commands { > READ_PORT, > WRITE_PORT, > @@ -486,12 +490,16 @@ static int ni6501_find_endpoints(struct comedi_device *dev) > ep_desc = &iface_desc->endpoint[i].desc; > > if (usb_endpoint_is_bulk_in(ep_desc)) { > + if (usb_endpoint_maxp(ep_desc) < RX_MAX_SIZE) > + continue; > if (!devpriv->ep_rx) > devpriv->ep_rx = ep_desc; > continue; > } > > if (usb_endpoint_is_bulk_out(ep_desc)) { > + if (usb_endpoint_maxp(ep_desc) < TX_MAX_SIZE) > + continue; > if (!devpriv->ep_tx) > devpriv->ep_tx = ep_desc; > continue; > Perhaps it should return an error if the first encountered bulk-in endpoint has the wrong size or the first encountered bulk-out endpoint has the wrong size. Something like: if (usb_endpoint_is_bulk_in(ep_desc)) { if (!devpriv->ep_rx) { if (usb_endpoint_maxp(ep_desc) < RX_MAX_SIZE) break; } continue; (similar for bulk-out with TX_MAX_SIZE)
On Tue, Oct 26, 2021 at 03:12:28PM +0100, Ian Abbott wrote: > On 25/10/2021 12:45, Johan Hovold wrote: > > The driver uses endpoint-sized USB transfer buffers but had no sanity > > checks on the sizes. This can lead to zero-size-pointer dereferences or > > overflowed transfer buffers in ni6501_port_command() and > > ni6501_counter_command() if a (malicious) device has smaller max-packet > > sizes than expected (or when doing descriptor fuzz testing). > > > > Add the missing sanity checks to probe(). > > > > Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support") > > Cc: stable@vger.kernel.org # 3.18 > > Cc: Luca Ellero <luca.ellero@brickedbrain.com> > > Signed-off-by: Johan Hovold <johan@kernel.org> > > --- > > drivers/comedi/drivers/ni_usb6501.c | 8 ++++++++ > > 1 file changed, 8 insertions(+) > > > > diff --git a/drivers/comedi/drivers/ni_usb6501.c b/drivers/comedi/drivers/ni_usb6501.c > > index 5b6d9d783b2f..eb2e5c23f25d 100644 > > --- a/drivers/comedi/drivers/ni_usb6501.c > > +++ b/drivers/comedi/drivers/ni_usb6501.c > > @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, > > 0x00, 0x00, 0x00, 0x02, > > 0x00, 0x00, 0x00, 0x00}; > > > > +/* Largest supported packets */ > > +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); > > +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); > > + > > enum commands { > > READ_PORT, > > WRITE_PORT, > > @@ -486,12 +490,16 @@ static int ni6501_find_endpoints(struct comedi_device *dev) > > ep_desc = &iface_desc->endpoint[i].desc; > > > > if (usb_endpoint_is_bulk_in(ep_desc)) { > > + if (usb_endpoint_maxp(ep_desc) < RX_MAX_SIZE) > > + continue; > > if (!devpriv->ep_rx) > > devpriv->ep_rx = ep_desc; > > continue; > > } > > > > if (usb_endpoint_is_bulk_out(ep_desc)) { > > + if (usb_endpoint_maxp(ep_desc) < TX_MAX_SIZE) > > + continue; > > if (!devpriv->ep_tx) > > devpriv->ep_tx = ep_desc; > > continue; > > > > Perhaps it should return an error if the first encountered bulk-in > endpoint has the wrong size or the first encountered bulk-out endpoint > has the wrong size. Something like: > > if (usb_endpoint_is_bulk_in(ep_desc)) { > if (!devpriv->ep_rx) { > if (usb_endpoint_maxp(ep_desc) < RX_MAX_SIZE) > break; > } > continue; This is too convoluted, but I can move the max-packet sanity checks after the endpoint look-ups instead. It doesn't really matter in the end as the real devices presumably only have two bulk endpoints. Johan
diff --git a/drivers/comedi/drivers/ni_usb6501.c b/drivers/comedi/drivers/ni_usb6501.c index 5b6d9d783b2f..eb2e5c23f25d 100644 --- a/drivers/comedi/drivers/ni_usb6501.c +++ b/drivers/comedi/drivers/ni_usb6501.c @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00}; +/* Largest supported packets */ +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); + enum commands { READ_PORT, WRITE_PORT, @@ -486,12 +490,16 @@ static int ni6501_find_endpoints(struct comedi_device *dev) ep_desc = &iface_desc->endpoint[i].desc; if (usb_endpoint_is_bulk_in(ep_desc)) { + if (usb_endpoint_maxp(ep_desc) < RX_MAX_SIZE) + continue; if (!devpriv->ep_rx) devpriv->ep_rx = ep_desc; continue; } if (usb_endpoint_is_bulk_out(ep_desc)) { + if (usb_endpoint_maxp(ep_desc) < TX_MAX_SIZE) + continue; if (!devpriv->ep_tx) devpriv->ep_tx = ep_desc; continue;
The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing). Add the missing sanity checks to probe(). Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support") Cc: stable@vger.kernel.org # 3.18 Cc: Luca Ellero <luca.ellero@brickedbrain.com> Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/comedi/drivers/ni_usb6501.c | 8 ++++++++ 1 file changed, 8 insertions(+)