| From 090aab62c096ba5f8f7c72f6f4b78b708d3a612c Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 10 Dec 2019 12:44:22 +0100 |
| Subject: [PATCH] brcmfmac: fix interface sanity check |
| |
| commit 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 upstream. |
| |
| Make sure to use the current alternate setting when verifying the |
| interface descriptors to avoid binding to an invalid interface. |
| |
| Failing to do so could cause the driver to misbehave or trigger a WARN() |
| in usb_submit_urb() that kernels with panic_on_warn set would choke on. |
| |
| Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") |
| Cc: stable <stable@vger.kernel.org> # 3.4 |
| Cc: Arend van Spriel <arend@broadcom.com> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |
| index 75fcd6752edc..cbc6004a0a56 100644 |
| --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |
| +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |
| @@ -1350,7 +1350,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) |
| goto fail; |
| } |
| |
| - desc = &intf->altsetting[0].desc; |
| + desc = &intf->cur_altsetting->desc; |
| if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) || |
| (desc->bInterfaceSubClass != 2) || |
| (desc->bInterfaceProtocol != 0xff)) { |
| @@ -1363,7 +1363,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) |
| |
| num_of_eps = desc->bNumEndpoints; |
| for (ep = 0; ep < num_of_eps; ep++) { |
| - endpoint = &intf->altsetting[0].endpoint[ep].desc; |
| + endpoint = &intf->cur_altsetting->endpoint[ep].desc; |
| endpoint_num = usb_endpoint_num(endpoint); |
| if (!usb_endpoint_xfer_bulk(endpoint)) |
| continue; |
| -- |
| 2.7.4 |
| |
