linux/drivers/usb
Nicolas Iooss 3958b79266 configfs: fix kernel infoleak through user-controlled format string
Some modules call config_item_init_type_name() and config_group_init_type_name()
with parameter "name" directly controlled by userspace.  These two
functions call config_item_set_name() with this name used as a format
string, which can be used to leak information such as content of the
stack to userspace.

For example, make_netconsole_target() in netconsole module calls
config_item_init_type_name() with the name of a newly-created directory.
This means that the following commands give some unexpected output, with
configfs mounted in /sys/kernel/config/ and on a system with a
configured eth0 ethernet interface:

    # modprobe netconsole
    # mkdir /sys/kernel/config/netconsole/target_%lx
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # dmesg |tail -n1
    [  142.697668] netconsole: target (target_ffffffffc0ae8080) is
    enabled, disable to update parameters

The directory name is correct but %lx has been interpreted in the
internal item name, displayed here in the error message used by
store_dev_name() in drivers/net/netconsole.c.

To fix this, update every caller of config_item_set_name to use "%s"
when operating on untrusted input.

This issue was found using -Wformat-security gcc flag, once a __printf
attribute has been added to config_item_set_name().

Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Felipe Balbi <balbi@ti.com>
Acked-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-07-17 16:39:53 -07:00
..
atm Minor merge needed, due to function move. 2015-07-01 10:49:25 -07:00
c67x00
chipidea USB Chipidea update for v4.2-rc1 2015-06-10 18:18:10 -07:00
class cdc-acm: Add support of ATOL FPrint fiscal printers 2015-06-08 14:01:13 -07:00
common
core usb: patches for v4.2 merge window 2015-06-02 10:47:03 +09:00
dwc2 usb: dwc2: embed storage for reg backup in struct dwc2_hsotg 2015-07-06 12:34:08 -05:00
dwc3 usb: dwc3: core: avoid NULL pointer dereference 2015-07-06 12:34:08 -05:00
early
gadget configfs: fix kernel infoleak through user-controlled format string 2015-07-17 16:39:53 -07:00
host Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2015-06-27 12:44:34 -07:00
image scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
isp1760 usb: isp1760: check for null return from kzalloc 2015-06-08 14:25:04 -07:00
misc USB patches for 4.2-rc1 2015-06-26 15:59:26 -07:00
mon
musb usb: musb: host: rely on port_mode to call musb_start() 2015-07-06 12:34:07 -05:00
phy usb: phy: mxs: suspend to RAM causes NULL pointer dereference 2015-07-06 12:34:08 -05:00
renesas_usbhs usb: patches for v4.2 merge window 2015-06-02 10:47:03 +09:00
serial USB: serial: Destroy serial_minors IDR on module exit 2015-07-09 10:41:23 +02:00
storage USB patches for 4.2-rc1 2015-06-26 15:59:26 -07:00
usbip
wusbcore
Kconfig
Makefile
README
usb-skeleton.c

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.