diff --git a/device/main/linux-purism-librem5/0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch b/device/main/linux-purism-librem5/0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch new file mode 100644 index 000000000..eff97685f --- /dev/null +++ b/device/main/linux-purism-librem5/0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch @@ -0,0 +1,111 @@ +From 36dfdf11af49d3c009c711fb16f5c6e7a274505d Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 9 Dec 2021 18:59:27 +0100 +Subject: USB: gadget: detect too-big endpoint 0 requests + +commit 153a2d7e3350cc89d406ba2d35be8793a64c2038 upstream. + +Sometimes USB hosts can ask for buffers that are too large from endpoint +0, which should not be allowed. If this happens for OUT requests, stall +the endpoint, but for IN requests, trim the request size to the endpoint +buffer size. + +Co-developed-by: Szymon Heidrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/composite.c | 12 ++++++++++++ + drivers/usb/gadget/legacy/dbgp.c | 13 +++++++++++++ + drivers/usb/gadget/legacy/inode.c | 16 +++++++++++++++- + 3 files changed, 40 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 504c1cbc255d1..1ef7922b57b62 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1679,6 +1679,18 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + struct usb_function *f = NULL; + u8 endp; + ++ if (w_length > USB_COMP_EP0_BUFSIZ) { ++ if (ctrl->bRequestType == USB_DIR_OUT) { ++ goto done; ++ } else { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ); ++ w_length = USB_COMP_EP0_BUFSIZ; ++ } ++ } ++ + /* partial re-init of the response message; the function or the + * gadget might need to intercept e.g. a control-OUT completion + * when we delegate to it. +diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c +index e1d566c9918ae..e567afcb2794c 100644 +--- a/drivers/usb/gadget/legacy/dbgp.c ++++ b/drivers/usb/gadget/legacy/dbgp.c +@@ -345,6 +345,19 @@ static int dbgp_setup(struct usb_gadget *gadget, + void *data = NULL; + u16 len = 0; + ++ if (length > DBGP_REQ_LEN) { ++ if (ctrl->bRequestType == USB_DIR_OUT) { ++ return err; ++ } else { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(DBGP_REQ_LEN); ++ length = DBGP_REQ_LEN; ++ } ++ } ++ ++ + if (request == USB_REQ_GET_DESCRIPTOR) { + switch (value>>8) { + case USB_DT_DEVICE: +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 539220d7f5b62..0a4041552ed19 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -110,6 +110,8 @@ enum ep0_state { + /* enough for the whole queue: most events invalidate others */ + #define N_EVENT 5 + ++#define RBUF_SIZE 256 ++ + struct dev_data { + spinlock_t lock; + refcount_t count; +@@ -144,7 +146,7 @@ struct dev_data { + struct dentry *dentry; + + /* except this scratch i/o buffer for ep0 */ +- u8 rbuf [256]; ++ u8 rbuf[RBUF_SIZE]; + }; + + static inline void get_dev (struct dev_data *data) +@@ -1334,6 +1336,18 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + u16 w_value = le16_to_cpu(ctrl->wValue); + u16 w_length = le16_to_cpu(ctrl->wLength); + ++ if (w_length > RBUF_SIZE) { ++ if (ctrl->bRequestType == USB_DIR_OUT) { ++ return value; ++ } else { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(RBUF_SIZE); ++ w_length = RBUF_SIZE; ++ } ++ } ++ + spin_lock (&dev->lock); + dev->setup_abort = 0; + if (dev->state == STATE_DEV_UNCONNECTED) { +-- +cgit 1.2.3-1.el7 + diff --git a/device/main/linux-purism-librem5/0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch b/device/main/linux-purism-librem5/0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch new file mode 100644 index 000000000..c15e89632 --- /dev/null +++ b/device/main/linux-purism-librem5/0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch @@ -0,0 +1,48 @@ +From 6eea4ace62fa6414432692ee44f0c0a3d541d97a Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 9 Dec 2021 19:02:15 +0100 +Subject: USB: gadget: zero allocate endpoint 0 buffers + +commit 86ebbc11bb3f60908a51f3e41a17e3f477c2eaa3 upstream. + +Under some conditions, USB gadget devices can show allocated buffer +contents to a host. Fix this up by zero-allocating them so that any +extra data will all just be zeros. + +Reported-by: Szymon Heidrich +Tested-by: Szymon Heidrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/composite.c | 2 +- + drivers/usb/gadget/legacy/dbgp.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 1ef7922b57b62..284eea9f6e4d8 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -2221,7 +2221,7 @@ int composite_dev_prepare(struct usb_composite_driver *composite, + if (!cdev->req) + return -ENOMEM; + +- cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL); ++ cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL); + if (!cdev->req->buf) + goto fail; + +diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c +index e567afcb2794c..355bc7dab9d5f 100644 +--- a/drivers/usb/gadget/legacy/dbgp.c ++++ b/drivers/usb/gadget/legacy/dbgp.c +@@ -137,7 +137,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep) + goto fail_1; + } + +- req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL); ++ req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL); + if (!req->buf) { + err = -ENOMEM; + stp = 2; +-- +cgit 1.2.3-1.el7 + diff --git a/device/main/linux-purism-librem5/APKBUILD b/device/main/linux-purism-librem5/APKBUILD index 8bda435e5..5c747384f 100644 --- a/device/main/linux-purism-librem5/APKBUILD +++ b/device/main/linux-purism-librem5/APKBUILD @@ -3,7 +3,7 @@ # Co-Maintainer: Bhushan Shah pkgname=linux-purism-librem5 pkgver=5.13.19 -pkgrel=2 +pkgrel=3 _purismrel=5 # . _purismver=${pkgver}pureos$_purismrel @@ -40,6 +40,8 @@ source=" 0001-bq25890_charger-enter-ship-mode-on-power-off.patch 0002-arm64-dts-imx8mq-librem5.dtsi-adjust-the-usdhc-bus-s.patch 0003-imx8mq-librem5-r3-Set-the-CPU-voltage-to-1.0V-when-r.patch + 0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch + 0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch $_config " builddir="$srcdir/$_repository-pureos-$_purismver" @@ -83,5 +85,7 @@ sha512sums=" 0e3caf6275247e31b874b94330dc4f991837a4b62f3c15a1f8ad39a7edd02ae499679bcd7ddc9463bb1c1a5073ea5980fa144a2ece804d72a6b2fc8c76c50766 0001-bq25890_charger-enter-ship-mode-on-power-off.patch 1dbf2adaf097bcce3ee179cd6b0f10d2ebefdc82191d34fffea8cb336c9dcbc66b717bf97a2e264b8068f178c0254f2b1281a09ae72d4825fd7b4a39916c0461 0002-arm64-dts-imx8mq-librem5.dtsi-adjust-the-usdhc-bus-s.patch c52f9e7e17f876697000a0c3b959a0d571ca506ba55ee5158e30ac00e148372097c88951a354190f669137a955405c87042a925c1bbe3cd91df40721650d45d3 0003-imx8mq-librem5-r3-Set-the-CPU-voltage-to-1.0V-when-r.patch +59d480b6379dcfff94d05b08e28c005d507f640dc0147841e7df4827fce8db01dab1d4d50fb45b2b3fff72cdeb219a8cd87a889078a6372aea4469c861c378b1 0004-CVE-2021-39685-USB-gadget-detect-too-big-endpoint-0-requests.patch +61f862cda24e7b14e55e9a9ce3a537adfc7a1c77e0670255dc485886e2c19156ddaf49fdd88b629ddde3cf25a83fd603678caebb96e18f59245917d3a2e51bb0 0005-CVE-2021-39685-USB-gadget-zero-allocate-endpoint-0-buffers.patch 5cf04237282a7f568ab56a79606c645d1275c0b47c4e452c9f41d736a8c63370f6ccc2958a855000e835e9b1db50fb0c756b1d47384448dfc82e975965a06926 config-purism-librem5.aarch64 "