| From c1b9ca365deae667192be9fe24db244919971234 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Wed, 27 Oct 2021 10:08:18 +0200 |
| Subject: ath6kl: fix division by zero in send path |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit c1b9ca365deae667192be9fe24db244919971234 upstream. |
| |
| Add the missing endpoint max-packet sanity check to probe() to avoid |
| division by zero in ath10k_usb_hif_tx_sg() in case a malicious device |
| has broken descriptors (or when doing descriptor fuzz testing). |
| |
| Note that USB core will reject URBs submitted for endpoints with zero |
| wMaxPacketSize but that drivers doing packet-size calculations still |
| need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip |
| endpoint descriptors with maxpacket=0")). |
| |
| Fixes: 9cbee358687e ("ath6kl: add full USB support") |
| Cc: stable@vger.kernel.org # 3.5 |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/drivers/net/wireless/ath/ath6kl/usb.c |
| +++ b/drivers/net/wireless/ath/ath6kl/usb.c |
| @@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resourc |
| le16_to_cpu(endpoint->wMaxPacketSize), |
| endpoint->bInterval); |
| } |
| + |
| + /* Ignore broken descriptors. */ |
| + if (usb_endpoint_maxp(endpoint) == 0) |
| + continue; |
| + |
| urbcount = 0; |
| |
| pipe_num = |
