| From a006acb931317aad3a8dd41333ebb0453caf49b8 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Wed, 27 Oct 2021 10:08:17 +0200 |
| Subject: ath10k: fix division by zero in send path |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream. |
| |
| Add the missing endpoint max-packet sanity check to probe() to avoid |
| division by zero in ath10k_usb_hif_tx_sg() in case a malicious device |
| has broken descriptors (or when doing descriptor fuzz testing). |
| |
| Note that USB core will reject URBs submitted for endpoints with zero |
| wMaxPacketSize but that drivers doing packet-size calculations still |
| need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip |
| endpoint descriptors with maxpacket=0")). |
| |
| Fixes: 4db66499df91 ("ath10k: add initial USB support") |
| Cc: stable@vger.kernel.org # 4.14 |
| Cc: Erik Stromdahl <erik.stromdahl@gmail.com> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Link: https://lore.kernel.org/r/20211027080819.6675-2-johan@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/wireless/ath/ath10k/usb.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/drivers/net/wireless/ath/ath10k/usb.c |
| +++ b/drivers/net/wireless/ath/ath10k/usb.c |
| @@ -865,6 +865,11 @@ static int ath10k_usb_setup_pipe_resourc |
| le16_to_cpu(endpoint->wMaxPacketSize), |
| endpoint->bInterval); |
| } |
| + |
| + /* Ignore broken descriptors. */ |
| + if (usb_endpoint_maxp(endpoint) == 0) |
| + continue; |
| + |
| urbcount = 0; |
| |
| pipe_num = |
