Commit 45b7d1be authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman

media: usb: siano: Fix general protection fault in smsusb

commit 31e0456d upstream.

The syzkaller USB fuzzer found a general-protection-fault bug in the
smsusb part of the Siano DVB driver.  The fault occurs during probe
because the driver assumes without checking that the device has both
IN and OUT endpoints and the IN endpoint is ep1.

By slightly rearranging the driver's initialization code, we can make
the appropriate checks early on and thus avoid the problem.  If the
expected endpoints aren't present, the new code safely returns -ENODEV
from the probe routine.
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+53f029db71c19a47325a@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
Reviewed-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 97059f28
...@@ -400,6 +400,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) ...@@ -400,6 +400,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
struct smsusb_device_t *dev; struct smsusb_device_t *dev;
void *mdev; void *mdev;
int i, rc; int i, rc;
int in_maxp;
/* create device object */ /* create device object */
dev = kzalloc(sizeof(struct smsusb_device_t), GFP_KERNEL); dev = kzalloc(sizeof(struct smsusb_device_t), GFP_KERNEL);
...@@ -411,6 +412,24 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) ...@@ -411,6 +412,24 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
dev->udev = interface_to_usbdev(intf); dev->udev = interface_to_usbdev(intf);
dev->state = SMSUSB_DISCONNECTED; dev->state = SMSUSB_DISCONNECTED;
for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
struct usb_endpoint_descriptor *desc =
&intf->cur_altsetting->endpoint[i].desc;
if (desc->bEndpointAddress & USB_DIR_IN) {
dev->in_ep = desc->bEndpointAddress;
in_maxp = usb_endpoint_maxp(desc);
} else {
dev->out_ep = desc->bEndpointAddress;
}
}
pr_debug("in_ep = %02x, out_ep = %02x\n", dev->in_ep, dev->out_ep);
if (!dev->in_ep || !dev->out_ep) { /* Missing endpoints? */
smsusb_term_device(intf);
return -ENODEV;
}
params.device_type = sms_get_board(board_id)->type; params.device_type = sms_get_board(board_id)->type;
switch (params.device_type) { switch (params.device_type) {
...@@ -425,24 +444,12 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) ...@@ -425,24 +444,12 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
/* fall-thru */ /* fall-thru */
default: default:
dev->buffer_size = USB2_BUFFER_SIZE; dev->buffer_size = USB2_BUFFER_SIZE;
dev->response_alignment = dev->response_alignment = in_maxp - sizeof(struct sms_msg_hdr);
le16_to_cpu(dev->udev->ep_in[1]->desc.wMaxPacketSize) -
sizeof(struct sms_msg_hdr);
params.flags |= SMS_DEVICE_FAMILY2; params.flags |= SMS_DEVICE_FAMILY2;
break; break;
} }
for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
if (intf->cur_altsetting->endpoint[i].desc. bEndpointAddress & USB_DIR_IN)
dev->in_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
else
dev->out_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
}
pr_debug("in_ep = %02x, out_ep = %02x\n",
dev->in_ep, dev->out_ep);
params.device = &dev->udev->dev; params.device = &dev->udev->dev;
params.usb_device = dev->udev; params.usb_device = dev->udev;
params.buffer_size = dev->buffer_size; params.buffer_size = dev->buffer_size;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment