summaryrefslogtreecommitdiffstats
path: root/usb-serial-visor-fix-crash-on-detecting-device-witho.patch
diff options
context:
space:
mode:
authorJosh Boyer <jwboyer@fedoraproject.org>2016-01-12 13:12:57 -0500
committerJosh Boyer <jwboyer@fedoraproject.org>2016-01-12 13:13:04 -0500
commit0c2a2f5349cef63c6a8d4bb53593fae904912054 (patch)
treedc1a8a37f58535a06a04bcf519e3c39b821320be /usb-serial-visor-fix-crash-on-detecting-device-witho.patch
parentc40143140b423e2fccbe0d971289a85b66af1cf7 (diff)
downloadkernel-0c2a2f5349cef63c6a8d4bb53593fae904912054.tar.gz
kernel-0c2a2f5349cef63c6a8d4bb53593fae904912054.tar.xz
kernel-0c2a2f5349cef63c6a8d4bb53593fae904912054.zip
CVE-2015-7566 usb: visor: Crash on invalid USB dev descriptors (rhbz 1296466 1297517)
Diffstat (limited to 'usb-serial-visor-fix-crash-on-detecting-device-witho.patch')
-rw-r--r--usb-serial-visor-fix-crash-on-detecting-device-witho.patch36
1 files changed, 36 insertions, 0 deletions
diff --git a/usb-serial-visor-fix-crash-on-detecting-device-witho.patch b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch
new file mode 100644
index 000000000..ddd4fc5b9
--- /dev/null
+++ b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch
@@ -0,0 +1,36 @@
+From b2476fe4c16be5c2b7ee950e50677cfaa9ab9bae Mon Sep 17 00:00:00 2001
+From: Vladis Dronov <vdronov@redhat.com>
+Date: Tue, 12 Jan 2016 14:10:50 -0500
+Subject: [PATCH] usb: serial: visor: fix crash on detecting device without
+ write_urbs
+
+The visor driver crashes in clie_5_attach() when a specially crafted USB
+device without bulk-out endpoint is detected. This fix adds a check that
+the device has proper configuration expected by the driver.
+
+Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+---
+ drivers/usb/serial/visor.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index 60afb39eb73c..bbc90c059002 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_serial *serial)
+ */
+
+ /* some sanity check */
+- if (serial->num_ports < 2)
+- return -1;
++ if (serial->num_bulk_out < 2) {
++ dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
++ return -ENODEV;
++ }
+
+ /* port 0 now uses the modified endpoint Address */
+ port = serial->port[0];
+--
+2.5.0
+