]> git.baikalelectronics.ru Git - kernel.git/commit
usb: core: fix slab-out-of-bounds Read in read_descriptors
authorZeng Tao <prime.zeng@hisilicon.com>
Fri, 4 Sep 2020 06:37:44 +0000 (14:37 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 4 Sep 2020 14:41:22 +0000 (16:41 +0200)
commit4dcde73917e594135d85b96a46827601628d2370
tree20129da790355f03bdc1ac902e036b550c170952
parent724a3b41fd1edb9c52e0c76476e237f44a104e12
usb: core: fix slab-out-of-bounds Read in read_descriptors

The USB device descriptor may get changed between two consecutive
enumerations on the same device for some reason, such as DFU or
malicius device.
In that case, we may access the changing descriptor if we don't take
the device lock here.

The issue is reported:
https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9

Cc: stable <stable@vger.kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
Fixes: 75e0c295706f ("USB: add all configs to the "descriptors" attribute")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/sysfs.c