USB: CVE-2018-20169

USB: check usb_get_extra_descriptor for proper size

References:
https://nvd.nist.gov/vuln/detail/CVE-2018-20169
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=fe26b8d06e965239795bee0a71c9073bed931716

Change-Id: I56a237c0e8c4ac8bd823f4b9f92f2bdb3d16a272
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 110 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index 9665d3f..0e01c9a 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -60,3 +60,6 @@ patch CVE-2018-16871-nfsd-COPY-and-CLONE-operations-require-the-saved-fil.patch
 
 #CVEs fixed in 4.9.144:
 patch CVE-2018-18690-xfs-don-t-fail-when-converting-shortform-attr-to-lon.patch
+
+#CVEs fixed in 4.9.145:
+patch CVE-2018-20169-USB-check-usb_get_extra_descriptor-for-proper-size.patch
diff --git a/patches/cve/CVE-2018-20169-USB-check-usb_get_extra_descriptor-for-proper-size.patch b/patches/cve/CVE-2018-20169-USB-check-usb_get_extra_descriptor-for-proper-size.patch
new file mode 100644
index 0000000..682d95b
--- /dev/null
+++ b/patches/cve/CVE-2018-20169-USB-check-usb_get_extra_descriptor-for-proper-size.patch
@@ -0,0 +1,107 @@
+From fe26b8d06e965239795bee0a71c9073bed931716 Mon Sep 17 00:00:00 2001
+From: Mathias Payer <mathias.payer@nebelwelt.net>
+Date: Wed, 5 Dec 2018 21:19:59 +0100
+Subject: [PATCH] USB: check usb_get_extra_descriptor for proper size
+
+commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.
+
+When reading an extra descriptor, we need to properly check the minimum
+and maximum size allowed, to prevent from invalid data being sent by a
+device.
+
+CVE: CVE-2018-20169
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=fe26b8d06e965239795bee0a71c9073bed931716]
+
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ drivers/usb/core/hub.c    | 2 +-
+ drivers/usb/core/usb.c    | 6 +++---
+ drivers/usb/host/hwa-hc.c | 2 +-
+ include/linux/usb.h       | 4 ++--
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 851f5a553de2..67679f619c3b 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2225,7 +2225,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
+                /* descriptor may appear anywhere in config */
+                err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
+                                le16_to_cpu(udev->config[0].desc.wTotalLength),
+-                               USB_DT_OTG, (void **) &desc);
++                               USB_DT_OTG, (void **) &desc, sizeof(*desc));
+                if (err || !(desc->bmAttributes & USB_OTG_HNP))
+                        return 0;
+ 
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index 891261b43c67..f3996ba71a59 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -696,14 +696,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
+  */
+ 
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+-                              unsigned char type, void **ptr)
++                              unsigned char type, void **ptr, size_t minsize)
+ {
+        struct usb_descriptor_header *header;
+ 
+        while (size >= sizeof(struct usb_descriptor_header)) {
+                header = (struct usb_descriptor_header *)buffer;
+ 
+-               if (header->bLength < 2) {
++               if (header->bLength < 2 || header->bLength > size) {
+                        printk(KERN_ERR
+                                "%s: bogus descriptor, type %d length %d\n",
+                                usbcore_name,
+@@ -712,7 +712,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+                        return -1;
+                }
+ 
+-               if (header->bDescriptorType == type) {
++               if (header->bDescriptorType == type && header->bLength >= minsize) {
+                        *ptr = header;
+                        return 0;
+                }
+diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
+index 1db0626c8bf4..97750f162f01 100644
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -654,7 +654,7 @@ static int hwahc_security_create(struct hwahc *hwahc)
+        top = itr + itr_size;
+        result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
+                        le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
+-                       USB_DT_SECURITY, (void **) &secd);
++                       USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
+        if (result == -1) {
+                dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
+                return 0;
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index eba1f10e8cfd..346665a0c49d 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -336,11 +336,11 @@ struct usb_host_bos {
+ };
+ 
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+-       unsigned char type, void **ptr);
++       unsigned char type, void **ptr, size_t min);
+ #define usb_get_extra_descriptor(ifpoint, type, ptr) \
+                                __usb_get_extra_descriptor((ifpoint)->extra, \
+                                (ifpoint)->extralen, \
+-                               type, (void **)ptr)
++                               type, (void **)ptr, sizeof(**(ptr)))
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+-- 
+2.20.1
+