forge/pmaports
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

linux-purism-librem5: backport fixes for CVE-2021-39685 (MR 2761)

Browse source 
[ci:skip-build] already built successfully in CI
This commit is contained in:
Clayton Craft 2021-12-16 09:39:47 -08:00
parent 5a175dc9d8
commit 20a0fee217
No known key found for this signature in database
GPG key ID: 4A4CED6D7EDF950A
3 changed files with 164 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

111
device/main/linux-purism-librem5/0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch Normal file
View file

@ -0,0 +1,111 @@
From 36dfdf11af49d3c009c711fb16f5c6e7a274505d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Dec 2021 18:59:27 +0100
Subject: USB: gadget: detect too-big endpoint 0 requests
commit 153a2d7e3350cc89d406ba2d35be8793a64c2038 upstream.
Sometimes USB hosts can ask for buffers that are too large from endpoint
0, which should not be allowed. If this happens for OUT requests, stall
the endpoint, but for IN requests, trim the request size to the endpoint
buffer size.
Co-developed-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/composite.c | 12 ++++++++++++
drivers/usb/gadget/legacy/dbgp.c | 13 +++++++++++++
drivers/usb/gadget/legacy/inode.c | 16 +++++++++++++++-
3 files changed, 40 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 504c1cbc255d1..1ef7922b57b62 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1679,6 +1679,18 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
struct usb_function *f = NULL;
u8 endp;
+ if (w_length > USB_COMP_EP0_BUFSIZ) {
+ if (ctrl->bRequestType == USB_DIR_OUT) {
+ goto done;
+ } else {
+ /* Cast away the const, we are going to overwrite on purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);
+ w_length = USB_COMP_EP0_BUFSIZ;
+ }
+ }
+
/* partial re-init of the response message; the function or the
* gadget might need to intercept e.g. a control-OUT completion
* when we delegate to it.
diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index e1d566c9918ae..e567afcb2794c 100644
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -345,6 +345,19 @@ static int dbgp_setup(struct usb_gadget *gadget,
void *data = NULL;
u16 len = 0;
+ if (length > DBGP_REQ_LEN) {
+ if (ctrl->bRequestType == USB_DIR_OUT) {
+ return err;
+ } else {
+ /* Cast away the const, we are going to overwrite on purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(DBGP_REQ_LEN);
+ length = DBGP_REQ_LEN;
+ }
+ }
+
+
if (request == USB_REQ_GET_DESCRIPTOR) {
switch (value>>8) {
case USB_DT_DEVICE:
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 539220d7f5b62..0a4041552ed19 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -110,6 +110,8 @@ enum ep0_state {
/* enough for the whole queue: most events invalidate others */
#define N_EVENT 5
+#define RBUF_SIZE 256
+
struct dev_data {
spinlock_t lock;
refcount_t count;
@@ -144,7 +146,7 @@ struct dev_data {
struct dentry *dentry;
/* except this scratch i/o buffer for ep0 */
- u8 rbuf [256];
+ u8 rbuf[RBUF_SIZE];
};
static inline void get_dev (struct dev_data *data)
@@ -1334,6 +1336,18 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
u16 w_value = le16_to_cpu(ctrl->wValue);
u16 w_length = le16_to_cpu(ctrl->wLength);
+ if (w_length > RBUF_SIZE) {
+ if (ctrl->bRequestType == USB_DIR_OUT) {
+ return value;
+ } else {
+ /* Cast away the const, we are going to overwrite on purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(RBUF_SIZE);
+ w_length = RBUF_SIZE;
+ }
+ }
+
spin_lock (&dev->lock);
dev->setup_abort = 0;
if (dev->state == STATE_DEV_UNCONNECTED) {
--
cgit 1.2.3-1.el7

48
device/main/linux-purism-librem5/0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch Normal file
View file

@ -0,0 +1,48 @@
From 6eea4ace62fa6414432692ee44f0c0a3d541d97a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Dec 2021 19:02:15 +0100
Subject: USB: gadget: zero allocate endpoint 0 buffers
commit 86ebbc11bb3f60908a51f3e41a17e3f477c2eaa3 upstream.
Under some conditions, USB gadget devices can show allocated buffer
contents to a host. Fix this up by zero-allocating them so that any
extra data will all just be zeros.
Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/composite.c | 2 +-
drivers/usb/gadget/legacy/dbgp.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 1ef7922b57b62..284eea9f6e4d8 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2221,7 +2221,7 @@ int composite_dev_prepare(struct usb_composite_driver *composite,
if (!cdev->req)
return -ENOMEM;
- cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
+ cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
if (!cdev->req->buf)
goto fail;
diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index e567afcb2794c..355bc7dab9d5f 100644
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -137,7 +137,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep)
goto fail_1;
}
- req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL);
+ req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL);
if (!req->buf) {
err = -ENOMEM;
stp = 2;
--
cgit 1.2.3-1.el7

6
device/main/linux-purism-librem5/APKBUILD
View file

@ -3,7 +3,7 @@
# Co-Maintainer: Bhushan Shah <bshah@kde.org>
pkgname=linux-purism-librem5
pkgver=5.13.19
pkgrel=2
pkgrel=3
_purismrel=5
# <kernel ver>.<purism kernel release>
_purismver=${pkgver}pureos$_purismrel
@ -40,6 +40,8 @@ source="
0001-bq25890_charger-enter-ship-mode-on-power-off.patch
0002-arm64-dts-imx8mq-librem5.dtsi-adjust-the-usdhc-bus-s.patch
0003-imx8mq-librem5-r3-Set-the-CPU-voltage-to-1.0V-when-r.patch
0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch
0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch
$_config
"
builddir="$srcdir/$_repository-pureos-$_purismver"
@ -83,5 +85,7 @@ sha512sums="
0e3caf6275247e31b874b94330dc4f991837a4b62f3c15a1f8ad39a7edd02ae499679bcd7ddc9463bb1c1a5073ea5980fa144a2ece804d72a6b2fc8c76c50766 0001-bq25890_charger-enter-ship-mode-on-power-off.patch
1dbf2adaf097bcce3ee179cd6b0f10d2ebefdc82191d34fffea8cb336c9dcbc66b717bf97a2e264b8068f178c0254f2b1281a09ae72d4825fd7b4a39916c0461 0002-arm64-dts-imx8mq-librem5.dtsi-adjust-the-usdhc-bus-s.patch
c52f9e7e17f876697000a0c3b959a0d571ca506ba55ee5158e30ac00e148372097c88951a354190f669137a955405c87042a925c1bbe3cd91df40721650d45d3 0003-imx8mq-librem5-r3-Set-the-CPU-voltage-to-1.0V-when-r.patch
59d480b6379dcfff94d05b08e28c005d507f640dc0147841e7df4827fce8db01dab1d4d50fb45b2b3fff72cdeb219a8cd87a889078a6372aea4469c861c378b1 0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch
61f862cda24e7b14e55e9a9ce3a537adfc7a1c77e0670255dc485886e2c19156ddaf49fdd88b629ddde3cf25a83fd603678caebb96e18f59245917d3a2e51bb0 0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch
5cf04237282a7f568ab56a79606c645d1275c0b47c4e452c9f41d736a8c63370f6ccc2958a855000e835e9b1db50fb0c756b1d47384448dfc82e975965a06926 config-purism-librem5.aarch64
"