Kernel oopses on access to address 0x8 when cdc-acm device is inserted with invalid descriptor.

[Adam Lee]

Invalid configuration descriptor as follows:

#+BEGIN_SRC text
0000 09 02 43 00 02 01 00 80 64 09 04 00 00 01 02 02 ..C.....d.......
0010 00 00 05 24 00 10 01 04 24 02 06 04 24 01 00 01 ...$....$...$...
0020 05 24 06 00 01 07 05 81 03 08 00 ff 09 04 01 00 .$..............
0030 02 0a 00 00 00 07 05 82 02 40 00 ff 07 05 01 02 .........@......
0040 20 00 ff ..
#+END_SRC text

In particular, the CDC Call Management Descriptor has its length
declared too short (4 instead of 5), and the following CDC Union
Descriptor is therefore unreachable.

*** Code problems:

1. The ~while (buflen > 0)~ loop that parses the interface aux data
   does not perform correct boundary checking. In the above case,
   ~call_interface_num = buffer[4];~ accesses outside of the
   (declared) descriptor content.
2. If a union header is missing, there is no code path that checks
   whether the ~data_interface~ (resolved from ~call_interface_num~)
   actually exists. Later ~if
   (data_interface->cur_altsetting->desc.bInterfaceClass~ dereferences
   ~data_interface~.

ref: https://bugzilla.kernel.org/show_bug.cgi?id=83551

issue 2 was already fixed, issue 1's fix is in progress of upstream merging, open this bug to track.

[Adam Lee (adam8157)]

patch "cdc-acm: add sanity checks" added to usb-next

[Adam Lee (adam8157)]

patch has been submitted to kernel-team@

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-utopic' to 'verification-done-utopic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-49.81

---------------
linux (3.13.0-49.81) trusty; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1436016

  [ Alex Hung ]

  * SAUCE: ACPI / blacklist: blacklist Win8 OSI for HP Pavilion dv6
    - LP: #1416940

  [ Andy Whitcroft ]

  * [Packaging] generate live watchdog blacklists
    - LP: #1432837

  [ Ben Widawsky ]

  * SAUCE: i915_bdw: drm/i915/bdw: enable eDRAM.
    - LP: #1430855

  [ Chris J Arges ]

  * [Config] Add ibmvfc to d-i
    - LP: #1416001

  [ Seth Forshee ]

  * [Config] updateconfigs - enable X86_UP_APIC_MSI

  [ Upstream Kernel Changes ]

  * net: add sysfs helpers for netdev_adjacent logic
    - LP: #1410852
  * net: Mark functions as static in core/dev.c
    - LP: #1410852
  * net: rename sysfs symlinks on device name change
    - LP: #1410852
  * btrfs: fix null pointer dereference in clone_fs_devices when name is
    null
    - LP: #1429804
  * cdc-acm: add sanity checks
    - LP: #1413992
  * x86: thinkpad_acpi.c: fixed spacing coding style issue
    - LP: #1417915
  * thinkpad_acpi: support new BIOS version string pattern
    - LP: #1417915
  * net: sctp: fix slab corruption from use after free on INIT collisions
    - LP: #1416506
    - CVE-2015-1421
  * ipv4: try to cache dst_entries which would cause a redirect
    - LP: #1420027
    - CVE-2015-1465
  * x86, mm/ASLR: Fix stack randomization on 64-bit systems
    - LP: #1423757
    - CVE-2015-1593
  * net: llc: use correct size for sysctl timeout entries
    - LP: #1425271
    - CVE-2015-2041
  * net: rds: use correct size for max unacked packets and bytes
    - LP: #1425274
    - CVE-2015-2042
  * Btrfs: clear compress-force when remounting with compress option
    - LP: #1434183
  * ext4: merge uninitialized extents
    - LP: #1430184
  * btrfs: filter invalid arg for btrfs resize
    - LP: #1435441
  * Bluetooth: Add firmware update for Atheros 0cf3:311f
  * Bluetooth: btusb: Add IMC Networks (Broadcom based)
  * Bluetooth: sort the list of IDs in the source code
  * Bluetooth: append new supported device to the list [0b05:17d0]
  * Bluetooth: Add support for Intel bootloader devices
  * Bluetooth: Ignore isochronous endpoints for Intel USB bootloader
  * Bluetooth: Add support for Acer [13D3:3432]
  * Bluetooth: Add support for Broadcom device of Asus Z97-DELUXE
    motherboard
  * Add a new PID/VID 0227/0930 for AR3012.
  * Bluetooth: Add support for Acer [0489:e078]
  * Bluetooth: Add USB device 04ca:3010 as Atheros AR3012
  * x86: mm: move mmap_sem unlock from mm_fault_error() to caller
  * vm: add VM_FAULT_SIGSEGV handling support
  * vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than
    SIGBUS
  * spi/pxa2xx: Clear cur_chip pointer before starting next message
  * spi: dw: Fix detecting FIFO depth
  * spi: dw-mid: fix FIFO size
  * ASoC: wm8960: Fix capture sample rate from 11250 to 11025
  * regulator: core: fix race condition in regulator_put()
  * ASoC: omap-mcbsp: Correct CBM_CFS dai format configuration
  * can: c_can: end pending transmission on network stop (ifdown)
  * nfs: fix dio deadlock when O_DIRECT flag is flipped
  * NFSv4.1: Fix an Oops in nfs41_...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.16.0-34.45

---------------
linux (3.16.0-34.45) utopic; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1435400

  [ Andy Whitcroft ]

  * [Packaging] generate live watchdog blacklists
    - LP: #1432837

  [ Chris J Arges ]

  * [Config] Add ibmvfc to d-i
    - LP: #1416001

  [ John Johansen ]

  * SAUCE: (no-up): apparmor: fix mediation of fs unix sockets
    - LP: #1408833

  [ Seth Forshee ]

  * [Config] updateconfigs - enable X86_UP_APIC_MSI

  [ Upstream Kernel Changes ]

  * cdc-acm: add sanity checks
    - LP: #1413992
  * x86: thinkpad_acpi.c: fixed spacing coding style issue
    - LP: #1417915
  * thinkpad_acpi: support new BIOS version string pattern
    - LP: #1417915
  * powernv: Use _GLOBAL_TOC for opal wrappers
    - LP: #1431196
  * Btrfs: clear compress-force when remounting with compress option
    - LP: #1434183
  * Btrfs: send, don't delay dir move if there's a new parent inode
    - LP: #1434223
  * [media] em28xx: fix em28xx-input removal
    - LP: #1434595
  * [media] em28xx: ensure "closing" messages terminate with a newline
    - LP: #1434595
  * [media] em28xx-input: fix missing newlines
    - LP: #1434595
  * [media] em28xx-core: fix missing newlines
    - LP: #1434595
  * [media] em28xx-audio: fix missing newlines
    - LP: #1434595
  * [media] em28xx-audio: fix missing newlines
    - LP: #1434595
  * [media] em28xx-dvb: fix missing newlines
    - LP: #1434595
  * [media] em28xx-video: fix missing newlines
    - LP: #1434595
  * ARM: pxa: add regulator_has_full_constraints to corgi board file
    - LP: #1434595
  * ARM: pxa: add regulator_has_full_constraints to poodle board file
    - LP: #1434595
  * ARM: pxa: add regulator_has_full_constraints to spitz board file
    - LP: #1434595
  * hx4700: regulator: declare full constraints
    - LP: #1434595
  * HID: input: fix confusion on conflicting mappings
    - LP: #1434595
  * HID: fixup the conflicting keyboard mappings quirk
    - LP: #1434595
  * ARM: dts: tegra20: fix GR3D, DSI unit and reg base addresses
    - LP: #1434595
  * megaraid_sas: disable interrupt_mask before enabling hardware
    interrupts
    - LP: #1434595
  * PCI: Generate uppercase hex for modalias var in uevent
    - LP: #1434595
  * usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN
    - LP: #1434595
  * tty/serial: at91: enable peripheral clock before accessing I/O
    registers
    - LP: #1434595
  * tty/serial: at91: fix error handling in atmel_serial_probe()
    - LP: #1434595
  * axonram: Fix bug in direct_access
    - LP: #1434595
  * btrfs: fix leak of path in btrfs_find_item
    - LP: #1434595
  * ksoftirqd: Enable IRQs and call cond_resched() before poking RCU
    - LP: #1434595
  * TPM: Add new TPMs to the tail of the list to prevent inadvertent change
    of dev
    - LP: #1434595
  * char: tpm: Add missing error check for devm_kzalloc
    - LP: #1434595
  * tpm_tis: verify interrupt during init
    - LP: #1434595
  * tpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma
    - LP: #1434595
  * tpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send
    - LP: #1434595
  * tpm/tpm_i2c_stm_st33:...