| From foo@baz Tue 01 Oct 2019 04:06:17 PM CEST |
| From: Bjørn Mork <bjorn@mork.no> |
| Date: Wed, 18 Sep 2019 14:01:46 +0200 |
| Subject: cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize |
| |
| From: Bjørn Mork <bjorn@mork.no> |
| |
| [ Upstream commit 3fe4b3351301660653a2bc73f2226da0ebd2b95e ] |
| |
| Endpoints with zero wMaxPacketSize are not usable for transferring |
| data. Ignore such endpoints when looking for valid in, out and |
| status pipes, to make the driver more robust against invalid and |
| meaningless descriptors. |
| |
| The wMaxPacketSize of the out pipe is used as divisor. So this change |
| fixes a divide-by-zero bug. |
| |
| Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com |
| Signed-off-by: Bjørn Mork <bjorn@mork.no> |
| Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/usb/cdc_ncm.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/usb/cdc_ncm.c |
| +++ b/drivers/net/usb/cdc_ncm.c |
| @@ -679,8 +679,12 @@ cdc_ncm_find_endpoints(struct usbnet *de |
| u8 ep; |
| |
| for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) { |
| - |
| e = intf->cur_altsetting->endpoint + ep; |
| + |
| + /* ignore endpoints which cannot transfer data */ |
| + if (!usb_endpoint_maxp(&e->desc)) |
| + continue; |
| + |
| switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) { |
| case USB_ENDPOINT_XFER_INT: |
| if (usb_endpoint_dir_in(&e->desc)) { |