android_kernel_oneplus_msm8998/drivers/usb
Ignat Korchagin 4a1bb501e4 USB: usbip: fix potential out-of-bounds write
commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb upstream.

Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.

Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-04 14:48:50 -07:00
..
atm USB: atm: cxacru: fix blank line after declaration 2015-07-22 14:55:22 -07:00
c67x00 c67x00-hcd: use USB_DT_HUB 2015-04-03 19:03:16 +02:00
chipidea usb: chipidea: otg: change workqueue ci_otg as freezable 2016-03-09 15:34:55 -08:00
class USB: cdc-acm: more sanity checking 2016-04-12 09:08:41 -07:00
common usb: common: of_usb_get_dr_mode to usb_get_dr_mode 2015-09-27 10:54:31 -05:00
core usb: hcd: out of bounds access in for_each_companion 2016-05-04 14:48:41 -07:00
dwc2 usb: dwc2: fix kernel oops during driver probe 2015-11-20 09:29:47 -06:00
dwc3 usb: dwc3: Fix assignment of EP transfer resources 2016-03-03 15:07:10 -08:00
early
gadget usb: gadget: f_fs: Fix use-after-free 2016-05-04 14:48:41 -07:00
host xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers 2016-05-04 14:48:41 -07:00
image scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
isp1760 usb: isp1760: udc: add ep capabilities support 2015-08-04 12:26:55 -05:00
misc USB: iowarrior: fix oops with malicious USB descriptors 2016-04-12 09:08:41 -07:00
mon USB: mon_stat.c: move assignment out of if () block 2015-05-10 16:01:11 +02:00
musb usb: musb: fail with error when no DMA controller set 2015-12-09 09:36:03 -06:00
phy usb: phy: msm: fix error handling in probe. 2016-02-17 12:31:01 -08:00
renesas_usbhs usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done() 2016-04-20 15:42:11 +09:00
serial USB: option: add "D-Link DWM-221 B1" device id 2016-04-12 09:08:42 -07:00
storage USB: uas: Add a new NO_REPORT_LUNS quirk 2016-04-20 15:42:07 +09:00
usbip USB: usbip: fix potential out-of-bounds write 2016-05-04 14:48:50 -07:00
wusbcore wusbcore: rh: use USB_DT_HUB 2015-04-03 19:03:15 +02:00
Kconfig usb: isp1760: Move driver from drivers/usb/host/ to drivers/usb/isp1760/ 2015-01-27 09:39:38 -06:00
Makefile usb-host: Remove fusbh200 driver 2015-10-16 23:44:33 -07:00
README
usb-skeleton.c

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.