[linux] 01/01: USB: whiteheat: fix potential null-deref at probe (CVE-2015-5257)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch squeeze-security
in repository linux.

commit db100db5f7ba9fe67b787419d02132a784327114
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Fri Oct 2 02:35:00 2015 +0100

    USB: whiteheat: fix potential null-deref at probe (CVE-2015-5257)
---
 debian/changelog                                   |  6 ++
 ...iteheat-fix-potential-null-deref-at-probe.patch | 79 ++++++++++++++++++++++
 debian/patches/series/48squeeze14                  |  1 +
 3 files changed, 86 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index c03a8bf..6f42795 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+linux-2.6 (2.6.32-48squeeze15) UNRELEASED; urgency=medium
+
+  * USB: whiteheat: fix potential null-deref at probe (CVE-2015-5257)
+
+ -- Ben Hutchings <ben at decadent.org.uk>  Fri, 02 Oct 2015 02:34:23 +0100
+
 linux-2.6 (2.6.32-48squeeze14) squeeze-lts; urgency=high
 
   [ Ben Hutchings ]
diff --git a/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch b/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
new file mode 100644
index 0000000..e4884b7
--- /dev/null
+++ b/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
@@ -0,0 +1,79 @@
+From: Johan Hovold <johan at kernel.org>
+Date: Wed, 23 Sep 2015 11:41:42 -0700
+Subject: USB: whiteheat: fix potential null-deref at probe
+Origin: https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git/commit?id=cbb4be652d374f64661137756b8f357a1827d6a4
+
+Fix potential null-pointer dereference at probe by making sure that the
+required endpoints are present.
+
+The whiteheat driver assumes there are at least five pairs of bulk
+endpoints, of which the final pair is used for the "command port". An
+attempt to bind to an interface with fewer bulk endpoints would
+currently lead to an oops.
+
+Fixes CVE-2015-5257.
+
+Reported-by: Moein Ghasemzadeh <moein at istuary.com>
+Cc: stable <stable at vger.kernel.org>
+Signed-off-by: Johan Hovold <johan at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 6c3734d..d3ea90b 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -143,6 +143,8 @@ static int  whiteheat_firmware_download(struct usb_serial *serial,
+ static int  whiteheat_firmware_attach(struct usb_serial *serial);
+ 
+ /* function prototypes for the Connect Tech WhiteHEAT serial converter */
++static int whiteheat_probe(struct usb_serial *serial,
++				const struct usb_device_id *id);
+ static int  whiteheat_attach(struct usb_serial *serial);
+ static void whiteheat_release(struct usb_serial *serial);
+ static int  whiteheat_open(struct tty_struct *tty,
+@@ -188,6 +190,7 @@ static struct usb_serial_driver whiteheat_device = {
+ 	.usb_driver =		&whiteheat_driver,
+ 	.id_table =		id_table_std,
+ 	.num_ports =		4,
++	.probe =		whiteheat_probe,
+ 	.attach =		whiteheat_attach,
+ 	.release =		whiteheat_release,
+ 	.open =			whiteheat_open,
+@@ -387,6 +390,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
+ /*****************************************************************************
+  * Connect Tech's White Heat serial driver functions
+  *****************************************************************************/
++
++static int whiteheat_probe(struct usb_serial *serial,
++				const struct usb_device_id *id)
++{
++	struct usb_host_interface *iface_desc;
++	struct usb_endpoint_descriptor *endpoint;
++	size_t num_bulk_in = 0;
++	size_t num_bulk_out = 0;
++	size_t min_num_bulk;
++	unsigned int i;
++
++	iface_desc = serial->interface->cur_altsetting;
++
++	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
++		endpoint = &iface_desc->endpoint[i].desc;
++		if (usb_endpoint_is_bulk_in(endpoint))
++			++num_bulk_in;
++		if (usb_endpoint_is_bulk_out(endpoint))
++			++num_bulk_out;
++	}
++
++	min_num_bulk = COMMAND_PORT + 1;
++	if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
++		return -ENODEV;
++
++	return 0;
++}
++
+ static int whiteheat_attach(struct usb_serial *serial)
+ {
+ 	struct usb_serial_port *command_port;
diff --git a/debian/patches/series/48squeeze14 b/debian/patches/series/48squeeze14
index 642acf2..420ef70 100644
--- a/debian/patches/series/48squeeze14
+++ b/debian/patches/series/48squeeze14
@@ -21,3 +21,4 @@
 + bugfix/all/stable/2.6.32.68.patch
 
 + bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch
++ bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git