summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRustam Kovhaev <rkovhaev@gmail.com>2020-07-22 09:10:52 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-07-22 19:49:37 +0200
commitfaaff9765664009c1c7c65551d32e9ed3b1dda8f (patch)
tree74153e438cd7de5117fba19e0ad6c63f74343c1d
parent926234f1b8434c4409aa4c53637aa3362ca07cea (diff)
downloadlinux-faaff9765664009c1c7c65551d32e9ed3b1dda8f.tar.gz
linux-faaff9765664009c1c7c65551d32e9ed3b1dda8f.tar.bz2
linux-faaff9765664009c1c7c65551d32e9ed3b1dda8f.zip
staging: wlan-ng: properly check endpoint types
As syzkaller detected, wlan-ng driver does not do sanity check of endpoints in prism2sta_probe_usb(), add check for xfer direction and type Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723 Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/staging/wlan-ng/prism2usb.c16
1 files changed, 15 insertions, 1 deletions
diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
index 4689b2170e4f..456603fd26c0 100644
--- a/drivers/staging/wlan-ng/prism2usb.c
+++ b/drivers/staging/wlan-ng/prism2usb.c
@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
const struct usb_device_id *id)
{
struct usb_device *dev;
-
+ const struct usb_endpoint_descriptor *epd;
+ const struct usb_host_interface *iface_desc = interface->cur_altsetting;
struct wlandevice *wlandev = NULL;
struct hfa384x *hw = NULL;
int result = 0;
+ if (iface_desc->desc.bNumEndpoints != 2) {
+ result = -ENODEV;
+ goto failed;
+ }
+
+ result = -EINVAL;
+ epd = &iface_desc->endpoint[1].desc;
+ if (!usb_endpoint_is_bulk_in(epd))
+ goto failed;
+ epd = &iface_desc->endpoint[2].desc;
+ if (!usb_endpoint_is_bulk_out(epd))
+ goto failed;
+
dev = interface_to_usbdev(interface);
wlandev = create_wlan();
if (!wlandev) {