usb: usbtest: fix NULL pointer dereference (CVE-2017-16532)

debian/changelog

@@ -124,6 +124,7 @@ linux (4.13.13-1) UNRELEASED; urgency=medium
   * swap: Avoid ABI change in 4.13.12
   * mac80211: use constant time comparison with keys
   * mac80211: don't compare TKIP TX MIC key in reinstall prevention
+  * usb: usbtest: fix NULL pointer dereference (CVE-2017-16532)
 
  -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 04 Nov 2017 09:54:41 +0100
 

debian/patches/bugfix/all/usb-usbtest-fix-NULL-pointer-dereference.patch

@@ -0,0 +1,39 @@
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 29 Sep 2017 10:54:24 -0400
+Subject: usb: usbtest: fix NULL pointer dereference
+Origin: https://git.kernel.org/linus/7c80f9e4a588f1925b07134bb2e3689335f6c6d8
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16532
+
+If the usbtest driver encounters a device with an IN bulk endpoint but
+no OUT bulk endpoint, it will try to dereference a NULL pointer
+(out->desc.bEndpointAddress).  The problem can be solved by adding a
+missing test.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+---
+ drivers/usb/misc/usbtest.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 113e38bfe0ef..b3fc602b2e24 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
+ 			return tmp;
+ 	}
+ 
+-	if (in) {
++	if (in)
+ 		dev->in_pipe = usb_rcvbulkpipe(udev,
+ 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
++	if (out)
+ 		dev->out_pipe = usb_sndbulkpipe(udev,
+ 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+-	}
++
+ 	if (iso_in) {
+ 		dev->iso_in = &iso_in->desc;
+ 		dev->in_iso_pipe = usb_rcvisocpipe(udev,

debian/patches/series

@@ -117,6 +117,7 @@ bugfix/all/mac80211-accept-key-reinstall-without-changing-anyth.patch
 bugfix/all/mac80211-use-constant-time-comparison-with-keys.patch
 bugfix/all/mac80211-don-t-compare-tkip-tx-mic-key-in-reinstall-.patch
 bugfix/all/sctp-do-not-peel-off-an-assoc-from-one-netns-to-anot.patch
+bugfix/all/usb-usbtest-fix-NULL-pointer-dereference.patch
 
 # Fix exported symbol versions
 bugfix/alpha/alpha-restore-symbol-versions-for-symbols-exported-f.patch