Commit 665c365a authored Oct 15, 2018 by Alan Stern Committed by Greg Kroah-Hartman Oct 16, 2018

USB: fix the usbfs flag sanitization for control transfers



Commit 7a68d9fb ("USB: usbdevfs: sanitize flags more") checks the
transfer flags for URBs submitted from userspace via usbfs.  However,
the check for whether the USBDEVFS_URB_SHORT_NOT_OK flag should be
allowed for a control transfer was added in the wrong place, before
the code has properly determined the direction of the control
transfer.  (Control transfers are special because for them, the
direction is set by the bRequestType byte of the Setup packet rather
than direction bit of the endpoint address.)

This patch moves code which sets up the allow_short flag for control
transfers down after is_in has been set to the correct value.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by:  <syzbot+24a30223a4b609bb802e@syzkaller.appspotmail.com>
Fixes: 7a68d9fb ("USB: usbdevfs: sanitize flags more")
CC: Oliver Neukum <oneukum@suse.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent c02588a3

drivers/usb/core/devio.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1474,8 +1474,6 @@ static int proc_do_submiturb(struct usb_dev_state ps, struct usbdevfs_urb uurb
		u = 0;
		switch (uurb->type) {
		case USBDEVFS_URB_TYPE_CONTROL:
		if (is_in)
		allow_short = true;
		if (!usb_endpoint_xfer_control(&ep->desc))
		return -EINVAL;
		/* min 8 byte setup packet */
		@@ -1505,6 +1503,8 @@ static int proc_do_submiturb(struct usb_dev_state ps, struct usbdevfs_urb uurb
		is_in = 0;
		uurb->endpoint &= ~USB_DIR_IN;
		}
		if (is_in)
		allow_short = true;
		snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
		"bRequest=%02x wValue=%04x "
		"wIndex=%04x wLength=%04x\n",

Admin message