diff options
| author | Rustam Kovhaev <rkovhaev@gmail.com> | 2020-07-22 09:10:52 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-07-29 07:42:56 +0200 |
| commit | 27e29448bde6c60a4a751c55bd92d3b78f793d9b (patch) | |
| tree | 9e97443d3fcd5ac72c7563c2b888eceb382dae01 | |
| parent | a9fb0709c26becfbf06e92ca75ec4daa9bf3af05 (diff) | |
| download | linux-stable-27e29448bde6c60a4a751c55bd92d3b78f793d9b.tar.gz linux-stable-27e29448bde6c60a4a751c55bd92d3b78f793d9b.tar.bz2 linux-stable-27e29448bde6c60a4a751c55bd92d3b78f793d9b.zip | |
staging: wlan-ng: properly check endpoint types
commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.
As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type
Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/wlan-ng/prism2usb.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c index d8d86761b790..8d32b1603d10 100644 --- a/drivers/staging/wlan-ng/prism2usb.c +++ b/drivers/staging/wlan-ng/prism2usb.c @@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface, const struct usb_device_id *id) { struct usb_device *dev; - + const struct usb_endpoint_descriptor *epd; + const struct usb_host_interface *iface_desc = interface->cur_altsetting; struct wlandevice *wlandev = NULL; struct hfa384x *hw = NULL; int result = 0; + if (iface_desc->desc.bNumEndpoints != 2) { + result = -ENODEV; + goto failed; + } + + result = -EINVAL; + epd = &iface_desc->endpoint[1].desc; + if (!usb_endpoint_is_bulk_in(epd)) + goto failed; + epd = &iface_desc->endpoint[2].desc; + if (!usb_endpoint_is_bulk_out(epd)) + goto failed; + dev = interface_to_usbdev(interface); wlandev = create_wlan(); if (!wlandev) { |