Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes: It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount. And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller...
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor { · 779 unmodified lines | |||
| 780 | __u8 iFunction; | 780 | __u8 iFunction; |
| 781 | } __attribute__ ((packed)); | 781 | } __attribute__ ((packed)); |
| 782 | 782 | ||
| 783 | #define USB_DT_INTERFACE_ASSOCIATION_SIZE 8 | ||
| 783 | 784 | ||
| 784 | /*-------------------------------------------------------------------------*/ | 785 | /*-------------------------------------------------------------------------*/ |
| 785 | 786 | ||