| From faaff9765664009c1c7c65551d32e9ed3b1dda8f Mon Sep 17 00:00:00 2001 |
| From: Rustam Kovhaev <rkovhaev@gmail.com> |
| Date: Wed, 22 Jul 2020 09:10:52 -0700 |
| Subject: staging: wlan-ng: properly check endpoint types |
| |
| From: Rustam Kovhaev <rkovhaev@gmail.com> |
| |
| commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream. |
| |
| As syzkaller detected, wlan-ng driver does not do sanity check of |
| endpoints in prism2sta_probe_usb(), add check for xfer direction and type |
| |
| Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com |
| Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723 |
| Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com> |
| Cc: stable <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/staging/wlan-ng/prism2usb.c | 16 +++++++++++++++- |
| 1 file changed, 15 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/staging/wlan-ng/prism2usb.c |
| +++ b/drivers/staging/wlan-ng/prism2usb.c |
| @@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct us |
| const struct usb_device_id *id) |
| { |
| struct usb_device *dev; |
| - |
| + const struct usb_endpoint_descriptor *epd; |
| + const struct usb_host_interface *iface_desc = interface->cur_altsetting; |
| wlandevice_t *wlandev = NULL; |
| hfa384x_t *hw = NULL; |
| int result = 0; |
| |
| + if (iface_desc->desc.bNumEndpoints != 2) { |
| + result = -ENODEV; |
| + goto failed; |
| + } |
| + |
| + result = -EINVAL; |
| + epd = &iface_desc->endpoint[1].desc; |
| + if (!usb_endpoint_is_bulk_in(epd)) |
| + goto failed; |
| + epd = &iface_desc->endpoint[2].desc; |
| + if (!usb_endpoint_is_bulk_out(epd)) |
| + goto failed; |
| + |
| dev = interface_to_usbdev(interface); |
| wlandev = create_wlan(); |
| if (wlandev == NULL) { |
