{"push_id":1027995516,"size":6,"distinct_size":6,"ref":"refs/heads/master","head":"040e3abbb958f5a038c16c1af7258e396303c2e1","before":"f7813ad5cbfd1fab2899914281b72a1ba0805c80","commits":[{"sha":"4ec0ef3a82125efc36173062a50624550a900ae0","author":{"email":"94755a79aca753e683bb6d0e796d473b797056eb@fedoraproject.org","name":"Josh Boyer"},"message":"USB: iowarrior: fix oops with malicious USB descriptors\n\nThe iowarrior driver expects at least one valid endpoint.  If given\nmalicious descriptors that specify 0 for the number of endpoints,\nit will crash in the probe function.  Ensure there is at least\none endpoint on the interface before using it.\n\nThe full report of this issue can be found here:\nhttp://seclists.org/bugtraq/2016/Mar/87\n\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Josh Boyer <jwboyer@fedoraproject.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/moontide/linux/commits/4ec0ef3a82125efc36173062a50624550a900ae0"},{"sha":"7222c832254a75dcd67d683df75753d4a4e125bb","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"usb/core: usb_alloc_dev(): fix setting of ->portnum\n\nWith commit 69bec7259853 (\"USB: core: let USB device know device node\"),\nthe port1 argument of usb_alloc_dev() gets overwritten as follows:\n\n  ... usb_alloc_dev(..., unsigned port1)\n  {\n    ...\n    if (!parent->parent) {\n      port1 = usb_hcd_find_raw_port_number(..., port1);\n    }\n    ...\n  }\n\nLater on, this now overwritten port1 gets assigned to ->portnum:\n\n  dev->portnum = port1;\n\nHowever, since xhci_find_raw_port_number() isn't idempotent, the\naforementioned commit causes a number of KASAN splats like the following:\n\n  BUG: KASAN: slab-out-of-bounds in xhci_find_raw_port_number+0x98/0x170\n                                       at addr ffff8801d9311670\n  Read of size 8 by task kworker/2:1/87\n  [...]\n  Workqueue: usb_hub_wq hub_event\n   0000000000000188 000000005814b877 ffff8800cba17588 ffffffff8191447e\n   0000000041b58ab3 ffffffff82a03209 ffffffff819143a2 ffffffff82a252f4\n   ffff8801d93115e0 0000000000000188 ffff8801d9311628 ffff8800cba17588\n  Call Trace:\n   [<ffffffff8191447e>] dump_stack+0xdc/0x15e\n   [<ffffffff819143a2>] ? _atomic_dec_and_lock+0xa2/0xa2\n   [<ffffffff814e2cd1>] ? print_section+0x61/0xb0\n   [<ffffffff814e4939>] print_trailer+0x179/0x2c0\n   [<ffffffff814f0d84>] object_err+0x34/0x40\n   [<ffffffff814f4388>] kasan_report_error+0x2f8/0x8b0\n   [<ffffffff814eb91e>] ? __slab_alloc+0x5e/0x90\n   [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130\n   [<ffffffff814f5091>] kasan_report+0x71/0xa0\n   [<ffffffff814ec082>] ? kmem_cache_alloc_trace+0x212/0x560\n   [<ffffffff81d99468>] ? xhci_find_raw_port_number+0x98/0x170\n   [<ffffffff814f33d4>] __asan_load8+0x64/0x70\n   [<ffffffff81d99468>] xhci_find_raw_port_number+0x98/0x170\n   [<ffffffff81db0105>] xhci_setup_addressable_virt_dev+0x235/0xa10\n   [<ffffffff81d9ea51>] xhci_setup_device+0x3c1/0x1430\n   [<ffffffff8121cddd>] ? trace_hardirqs_on+0xd/0x10\n   [<ffffffff81d9fac0>] ? xhci_setup_device+0x1430/0x1430\n   [<ffffffff81d9fad3>] xhci_address_device+0x13/0x20\n   [<ffffffff81d2081a>] hub_port_init+0x55a/0x1550\n   [<ffffffff81d28705>] hub_event+0xef5/0x24d0\n   [<ffffffff81d27810>] ? hub_port_debounce+0x2f0/0x2f0\n   [<ffffffff8195e1ee>] ? debug_object_deactivate+0x1be/0x270\n   [<ffffffff81210203>] ? print_rt_rq+0x53/0x2d0\n   [<ffffffff8121657d>] ? trace_hardirqs_off+0xd/0x10\n   [<ffffffff8226acfb>] ? _raw_spin_unlock_irqrestore+0x5b/0x60\n   [<ffffffff81250000>] ? irq_domain_set_hwirq_and_chip+0x30/0xb0\n   [<ffffffff81256339>] ? debug_lockdep_rcu_enabled+0x39/0x40\n   [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130\n   [<ffffffff81196877>] process_one_work+0x567/0xec0\n  [...]\n\nAfterwards, xhci reports some functional errors:\n\n  xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion\n                                code 0x11.\n  xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion\n                                code 0x11.\n  usb 4-3: device not accepting address 2, error -22\n\nFix this by not overwriting the port1 argument in usb_alloc_dev(), but\nstoring the raw port number as required by OF in an additional variable,\nraw_port.\n\nFixes: 69bec7259853 (\"USB: core: let USB device know device node\")\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/moontide/linux/commits/7222c832254a75dcd67d683df75753d4a4e125bb"},{"sha":"0b818e3956fc1ad976bee791eadcbb3b5fec5bfd","author":{"email":"bfee72d94d376f4e00f72b756466867d7f9eb24e@suse.com","name":"Oliver Neukum"},"message":"USB: usb_driver_claim_interface: add sanity checking\n\nAttacks that trick drivers into passing a NULL pointer\nto usb_driver_claim_interface() using forged descriptors are\nknown. This thwarts them by sanity checking.\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/moontide/linux/commits/0b818e3956fc1ad976bee791eadcbb3b5fec5bfd"},{"sha":"8835ba4a39cf53f705417b3b3a94eb067673f2c9","author":{"email":"bfee72d94d376f4e00f72b756466867d7f9eb24e@suse.com","name":"Oliver Neukum"},"message":"USB: cdc-acm: more sanity checking\n\nAn attack has become available which pretends to be a quirky\ndevice circumventing normal sanity checks and crashes the kernel\nby an insufficient number of interfaces. This patch adds a check\nto the code path for quirky devices.\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/moontide/linux/commits/8835ba4a39cf53f705417b3b3a94eb067673f2c9"},{"sha":"55ff8cfbc4e12a7d2187df523938cc671fbebdd1","author":{"email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com","name":"Hans de Goede"},"message":"USB: uas: Reduce can_queue to MAX_CMNDS\n\nThe uas driver can never queue more then MAX_CMNDS (- 1) tags and tags\nare shared between luns, so there is no need to claim that we can_queue\nsome random large number.\n\nNot claiming that we can_queue 65536 commands, fixes the uas driver\nfailing to initialize while allocating the tag map with a \"Page allocation\nfailure (order 7)\" error on systems which have been running for a while\nand thus have fragmented memory.\n\nCc: stable@vger.kernel.org\nReported-and-tested-by: Yves-Alexis Perez <corsac@corsac.net>\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/moontide/linux/commits/55ff8cfbc4e12a7d2187df523938cc671fbebdd1"},{"sha":"040e3abbb958f5a038c16c1af7258e396303c2e1","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Merge tag 'usb-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here is a USB fix for the reported issue with commit 69bec7259853\n  (\"USB: core: let USB device know device node\") as well as some other\n  issues that have been reported so far with this merge window\"\n\n* tag 'usb-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n  USB: uas: Reduce can_queue to MAX_CMNDS\n  USB: cdc-acm: more sanity checking\n  USB: usb_driver_claim_interface: add sanity checking\n  usb/core: usb_alloc_dev(): fix setting of ->portnum\n  USB: iowarrior: fix oops with malicious USB descriptors","distinct":true,"url":"https://api.github.com/repos/moontide/linux/commits/040e3abbb958f5a038c16c1af7258e396303c2e1"}]}