Skip to content

Commit 950336b

Browse files
nefigtutdtor
authored andcommitted
Input: ati_remote2 - fix crashes on detecting device with invalid descriptor
The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
1 parent 82be788 commit 950336b

File tree

1 file changed

+30
-6
lines changed

1 file changed

+30
-6
lines changed

Diff for: drivers/input/misc/ati_remote2.c

+30-6
Original file line numberDiff line numberDiff line change
@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
817817

818818
ar2->udev = udev;
819819

820+
/* Sanity check, first interface must have an endpoint */
821+
if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
822+
dev_err(&interface->dev,
823+
"%s(): interface 0 must have an endpoint\n", __func__);
824+
r = -ENODEV;
825+
goto fail1;
826+
}
820827
ar2->intf[0] = interface;
821828
ar2->ep[0] = &alt->endpoint[0].desc;
822829

830+
/* Sanity check, the device must have two interfaces */
823831
ar2->intf[1] = usb_ifnum_to_if(udev, 1);
832+
if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
833+
dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
834+
__func__, udev->actconfig->desc.bNumInterfaces);
835+
r = -ENODEV;
836+
goto fail1;
837+
}
838+
824839
r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
825840
if (r)
826841
goto fail1;
842+
843+
/* Sanity check, second interface must have an endpoint */
827844
alt = ar2->intf[1]->cur_altsetting;
845+
if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
846+
dev_err(&interface->dev,
847+
"%s(): interface 1 must have an endpoint\n", __func__);
848+
r = -ENODEV;
849+
goto fail2;
850+
}
828851
ar2->ep[1] = &alt->endpoint[0].desc;
829852

830853
r = ati_remote2_urb_init(ar2);
831854
if (r)
832-
goto fail2;
855+
goto fail3;
833856

834857
ar2->channel_mask = channel_mask;
835858
ar2->mode_mask = mode_mask;
836859

837860
r = ati_remote2_setup(ar2, ar2->channel_mask);
838861
if (r)
839-
goto fail2;
862+
goto fail3;
840863

841864
usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
842865
strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
@@ -845,22 +868,23 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
845868

846869
r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
847870
if (r)
848-
goto fail2;
871+
goto fail3;
849872

850873
r = ati_remote2_input_init(ar2);
851874
if (r)
852-
goto fail3;
875+
goto fail4;
853876

854877
usb_set_intfdata(interface, ar2);
855878

856879
interface->needs_remote_wakeup = 1;
857880

858881
return 0;
859882

860-
fail3:
883+
fail4:
861884
sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
862-
fail2:
885+
fail3:
863886
ati_remote2_urb_cleanup(ar2);
887+
fail2:
864888
usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
865889
fail1:
866890
kfree(ar2);

0 commit comments

Comments
 (0)