korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-16 07:24:39 +08:00
Code Issues Packages Projects Releases Wiki Activity
7d7e21fafd
linux/drivers
History
Johan Hovold 7d7e21fafd USB: serial: keyspan: fix NULL-derefs on open() and write() 
Fix NULL-pointer dereferences on open() and write() which can be
triggered by a malicious USB device.

The current URB allocation helper would fail to initialise the newly
allocated URB if the device has unexpected endpoint descriptors,
something which could lead NULL-pointer dereferences in a number of
open() and write() paths when accessing the URB. For example:

	BUG: kernel NULL pointer dereference, address: 0000000000000000
	...
	RIP: 0010:usb_clear_halt+0x11/0xc0
	...
	Call Trace:
	 ? tty_port_open+0x4d/0xd0
	 keyspan_open+0x70/0x160 [keyspan]
	 serial_port_activate+0x5b/0x80 [usbserial]
	 tty_port_open+0x7b/0xd0
	 ? check_tty_count+0x43/0xa0
	 tty_open+0xf1/0x490

	BUG: kernel NULL pointer dereference, address: 0000000000000000
	...
	RIP: 0010:keyspan_write+0x14e/0x1f3 [keyspan]
	...
	Call Trace:
	 serial_write+0x43/0xa0 [usbserial]
	 n_tty_write+0x1af/0x4f0
	 ? do_wait_intr_irq+0x80/0x80
	 ? process_echoes+0x60/0x60
	 tty_write+0x13f/0x2f0

	BUG: kernel NULL pointer dereference, address: 0000000000000000
	...
	RIP: 0010:keyspan_usa26_send_setup+0x298/0x305 [keyspan]
	...
	Call Trace:
	 keyspan_open+0x10f/0x160 [keyspan]
	 serial_port_activate+0x5b/0x80 [usbserial]
	 tty_port_open+0x7b/0xd0
	 ? check_tty_count+0x43/0xa0
	 tty_open+0xf1/0x490

Fixes: fdcba53e2d ("fix for bugzilla #7544 (keyspan USB-to-serial converter)")
Cc: stable <stable@vger.kernel.org>	# 2.6.21
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2019-10-04 10:57:19 +02:00
..
accessibility
acpi Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-09-28 08:14:15 -07:00
amba ARM updates for 5.4-rc1: 2019-09-22 09:39:09 -07:00
android
ata ata: libahci_platform: Add of_node_put() before loop exit 2019-09-19 12:21:44 -06:00
atm atm: he: clean up an indentation issue 2019-09-25 13:54:45 +02:00
auxdisplay It's a somewhat calmer cycle for docs this time, as the churn of the mass 2019-09-17 16:22:26 -07:00
base mm,thp: stats for file backed THP 2019-09-24 15:54:11 -07:00
bcma bcma: make arrays pwr_info_offset and sprom_sizes static const, shrinks object size 2019-09-13 16:44:49 +03:00
block Merge branch 'akpm' (patches from Andrew) 2019-09-26 10:29:42 -07:00
bluetooth Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-09-15 14:17:27 +02:00
bus ARM: SoC fixes 2019-09-30 10:04:28 -07:00
cdrom
char Merge branch 'entropy' 2019-09-29 19:25:39 -07:00
clk ARM SCMI fixes for v5.4 2019-09-29 11:20:41 -07:00
clocksource Main MIPS changes for v5.4: 2019-09-22 09:30:30 -07:00
connector
counter
cpufreq Power management updates for 5.4-rc1 2019-09-17 19:15:14 -07:00
cpuidle Power management updates for 5.4-rc1 2019-09-17 19:15:14 -07:00
crypto Merge branch 'akpm' (patches from Andrew) 2019-09-24 16:10:23 -07:00
dax
dca
devfreq
dio
dma Main MIPS changes for v5.4: 2019-09-22 09:30:30 -07:00
dma-buf
edac ARM updates for 5.4-rc1: 2019-09-22 09:39:09 -07:00
eisa
extcon chrome platform changes for v5.4 2019-09-19 14:14:28 -07:00
firewire
firmware ARM: SoC fixes 2019-09-30 10:04:28 -07:00
fpga Char/Misc driver patches for 5.4-rc1 2019-09-18 11:14:31 -07:00
fsi
gnss
gpio pwm: Changes for v5.4-rc1 2019-09-27 12:19:47 -07:00
gpu drm fixes for 5.4-rc1 2019-09-27 11:13:35 -07:00
greybus
hid - First round of vmbus hibernation support from Dexuan Cui. 2019-09-24 12:36:31 -07:00
hsi HSI changes for the 5.4 series 2019-09-22 12:02:21 -07:00
hv - First round of vmbus hibernation support from Dexuan Cui. 2019-09-24 12:36:31 -07:00
hwmon ARM SCMI fixes for v5.4 2019-09-29 11:20:41 -07:00
hwspinlock
hwtracing Char/Misc driver patches for 5.4-rc1 2019-09-18 11:14:31 -07:00
i2c i2c: slave-eeprom: Add read only mode 2019-09-28 20:44:12 +02:00
i3c
ide
idle
iio chrome platform changes for v5.4 2019-09-19 14:14:28 -07:00
infiniband Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-09-28 17:47:33 -07:00
input chrome platform changes for v5.4 2019-09-19 14:14:28 -07:00
interconnect
iommu IOMMU Fixes for Linux v5.4-rc1 2019-09-29 10:00:14 -07:00
ipack
irqchip Main MIPS changes for v5.4: 2019-09-22 09:30:30 -07:00
isdn mISDN: enforce CAP_NET_RAW for raw sockets 2019-09-24 16:37:18 +02:00
leds leds: lm3532: Fix optional led-max-microamp prop error handling 2019-09-12 20:45:52 +02:00
lightnvm
macintosh
mailbox mailbox: qcom-apcs: fix max_register value 2019-09-17 00:54:29 -05:00
mcb
md for-5.4/post-2019-09-24 2019-09-24 16:31:50 -07:00
media media/v4l2-core: untag user pointers in videobuf_dma_contig_user_get 2019-09-25 17:51:41 -07:00
memory
memstick ms_block: fix spelling mistake "randomally" -> "randomly" 2019-09-11 16:11:01 +02:00
message
mfd Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal 2019-09-29 10:24:23 -07:00
misc Merge branch 'i2c/for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2019-09-24 16:48:02 -07:00
mmc mmc: host: sdhci-pci: Add Genesys Logic GL975x support 2019-09-27 20:48:20 +02:00
mtd Main MIPS changes for v5.4: 2019-09-22 09:30:30 -07:00
mux
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-09-28 17:47:33 -07:00
nfc NFC: st95hf: clean up indentation issue 2019-09-27 20:31:18 +02:00
ntb NTB: fix IDT Kconfig typos/spellos 2019-09-23 17:20:40 -04:00
nubus
nvdimm libnvdimm fixes v5.4-rc1 2019-09-29 10:33:41 -07:00
nvme for-5.4/post-2019-09-24 2019-09-24 16:31:50 -07:00
nvmem Char/Misc driver patches for 5.4-rc1 2019-09-18 11:14:31 -07:00
of Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-09-28 17:47:33 -07:00
opp
oprofile
parisc dma-mapping updates for 5.4: 2019-09-19 13:27:23 -07:00
parport Char/Misc driver patches for 5.4-rc1 2019-09-18 11:14:31 -07:00
pci Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-09-28 08:14:15 -07:00
pcmcia Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-09-28 08:14:15 -07:00
perf
phy pci-v5.4-changes 2019-09-23 19:16:01 -07:00
pinctrl This is the bulk of pin control changes for the v5.4 kernel 2019-09-19 14:19:33 -07:00
platform platform-drivers-x86 for v5.4-2 2019-09-24 12:39:40 -07:00
pnp
power power supply and reset changes for the v5.4 series 2019-09-22 12:04:59 -07:00
powercap Power management updates for 5.4-rc1 2019-09-17 19:15:14 -07:00
pps
ps3
ptp ptp: correctly disable flags on old ioctls 2019-09-27 20:25:32 +02:00
pwm pwm: Changes for v5.4-rc1 2019-09-27 12:19:47 -07:00
rapidio
ras
regulator LED updates for 5.4-rc1 2019-09-17 18:40:42 -07:00
remoteproc remoteproc updates for v5.4 2019-09-22 10:55:08 -07:00
reset ARM: SoC fixes 2019-09-30 10:04:28 -07:00
rpmsg rpmsg: glink-smem: Name the edge based on parent remoteproc 2019-09-17 15:33:31 -07:00
rtc RTC for 5.4 2019-09-22 11:05:43 -07:00
s390 s390 updates for the 5.4 merge window #2 2019-09-26 11:30:16 -07:00
sbus
scsi for-5.4/post-2019-09-24 2019-09-24 16:31:50 -07:00
sfi
sh
siox
slimbus
soc ARM: SoC driver updates for v5.4 2019-09-16 15:52:38 -07:00
soundwire soundwire updates for v5.4-rc1 2019-09-22 10:52:23 -07:00
spi LED updates for 5.4-rc1 2019-09-17 18:40:42 -07:00
spmi
ssb ssb: make array pwr_info_offset static const, makes object smaller 2019-09-13 17:23:18 +03:00
staging mm: introduce page_size() 2019-09-24 15:54:08 -07:00
target mm: introduce page_size() 2019-09-24 15:54:08 -07:00
tc
tee tee/shm: untag user pointers in tee_shm_register 2019-09-25 17:51:41 -07:00
thermal Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal 2019-09-29 10:24:23 -07:00
thunderbolt
tty Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-09-28 08:14:15 -07:00
uio Char/Misc driver patches for 5.4-rc1 2019-09-18 11:14:31 -07:00
usb USB: serial: keyspan: fix NULL-derefs on open() and write() 2019-10-04 10:57:19 +02:00
vfio vfio/type1: untag user pointers in vaddr_get_pfn 2019-09-25 17:51:41 -07:00
vhost Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-09-15 14:17:27 +02:00
video - Core Frameworks 2019-09-23 19:33:56 -07:00
virt
virtio virtio_ring: fix unmap of indirect descriptors 2019-09-09 10:43:15 -04:00
visorbus
vlynq
vme
w1
watchdog linux-watchdog 5.4-rc1 tag 2019-09-27 11:17:38 -07:00
xen xen: features for 5.4-rc1 2019-09-26 11:22:14 -07:00
zorro
Kconfig Staging/IIO driver patches for 5.4-rc1 2019-09-18 11:05:34 -07:00
Makefile Staging/IIO driver patches for 5.4-rc1 2019-09-18 11:05:34 -07:00