linux/drivers/usb/gadget
Andrzej Pietrasiewicz a0456399fb usb: gadget: configfs: don't NUL-terminate (sub)compatible ids
The "Extended Compat ID OS Feature Descriptor Specification" does not
require the (sub)compatible ids to be NUL-terminated, because they
are placed in a fixed-size buffer and only unused parts of it should
contain NULs. If the buffer is fully utilized, there is no place for NULs.

Consequently, the code which uses desc->ext_compat_id never expects the
data contained to be NUL terminated.

If the compatible id is stored after sub-compatible id, and the compatible
id is full length (8 bytes), the (useless) NUL terminator overwrites the
first byte of the sub-compatible id.

If the sub-compatible id is full length (8 bytes), the (useless) NUL
terminator ends up out of the buffer. The situation can happen in the RNDIS
function, where the buffer is a part of struct f_rndis_opts. The next
member of struct f_rndis_opts is a mutex, so its first byte gets
overwritten. The said byte is a part of a mutex'es member which contains
the information on whether the muext is locked or not. This can lead to a
deadlock, because, in a configfs-composed gadget when a function is linked
into a configuration with config_usb_cfg_link(), usb_get_function()
is called, which then calls rndis_alloc(), which tries locking the same
mutex and (wrongly) finds it already locked.

This patch eliminates NUL terminating of the (sub)compatible id.

Cc: <stable@vger.kernel.org> # v3.16+
Fixes: da4243145f: "usb: gadget: configfs: OS Extended Compatibility descriptors support"
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-02-23 09:37:27 -06:00
..
function usb: gadget: function: uvc_v4l2.c: fix sparse warnings 2015-02-23 09:23:46 -06:00
legacy usb: gadget: gadgetfs: fix sparse warnings 2015-02-23 09:23:20 -06:00
udc Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2015-02-19 10:36:45 -08:00
composite.c usb: gadget: Fix os desc test 2015-01-27 09:34:58 -06:00
config.c usb: gadget: always update HS/SS descriptors and create a copy of them 2012-10-31 15:09:44 +02:00
configfs.c usb: gadget: configfs: don't NUL-terminate (sub)compatible ids 2015-02-23 09:37:27 -06:00
configfs.h usb: gadget: OS descriptors: provide interface directory names 2014-06-19 10:06:48 -05:00
epautoconf.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
Kconfig Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2015-02-19 10:36:45 -08:00
Makefile usb: gadget: use $(srctree) instead of $(PWD) for includes 2014-08-29 15:53:46 -05:00
u_f.c usb: gadget: only GPL drivers in the gadget and phy framework 2014-04-21 14:07:12 -05:00
u_f.h usb: gadget: FunctionFS: share VLA macros with all usb gadget files 2014-05-14 09:37:27 -05:00
u_os_desc.h usb: gadget: u_os_desc: helper functions for accessing ext prop buffer 2014-07-10 08:36:51 -05:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00