| From b5e6fa7a12572c82f1e7f2f51fbb02a322291291 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Mon, 25 Oct 2021 13:39:44 +0200 |
| Subject: Bluetooth: bfusb: fix division by zero in send path |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit b5e6fa7a12572c82f1e7f2f51fbb02a322291291 upstream. |
| |
| Add the missing bulk-out endpoint sanity check to probe() to avoid |
| division by zero in bfusb_send_frame() in case a malicious device has |
| broken descriptors (or when doing descriptor fuzz testing). |
| |
| Note that USB core will reject URBs submitted for endpoints with zero |
| wMaxPacketSize but that drivers doing packet-size calculations still |
| need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip |
| endpoint descriptors with maxpacket=0")). |
| |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Marcel Holtmann <marcel@holtmann.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/bluetooth/bfusb.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/bluetooth/bfusb.c |
| +++ b/drivers/bluetooth/bfusb.c |
| @@ -644,6 +644,9 @@ static int bfusb_probe(struct usb_interf |
| data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress; |
| data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); |
| |
| + if (!data->bulk_pkt_size) |
| + goto done; |
| + |
| rwlock_init(&data->lock); |
| |
| data->reassembly = NULL; |
