Commit faaff976 authored by Rustam Kovhaev's avatar Rustam Kovhaev Committed by Greg Kroah-Hartman

staging: wlan-ng: properly check endpoint types

As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type

Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723Signed-off-by: default avatarRustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 926234f1
...@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface, ...@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
const struct usb_device_id *id) const struct usb_device_id *id)
{ {
struct usb_device *dev; struct usb_device *dev;
const struct usb_endpoint_descriptor *epd;
const struct usb_host_interface *iface_desc = interface->cur_altsetting;
struct wlandevice *wlandev = NULL; struct wlandevice *wlandev = NULL;
struct hfa384x *hw = NULL; struct hfa384x *hw = NULL;
int result = 0; int result = 0;
if (iface_desc->desc.bNumEndpoints != 2) {
result = -ENODEV;
goto failed;
}
result = -EINVAL;
epd = &iface_desc->endpoint[1].desc;
if (!usb_endpoint_is_bulk_in(epd))
goto failed;
epd = &iface_desc->endpoint[2].desc;
if (!usb_endpoint_is_bulk_out(epd))
goto failed;
dev = interface_to_usbdev(interface); dev = interface_to_usbdev(interface);
wlandev = create_wlan(); wlandev = create_wlan();
if (!wlandev) { if (!wlandev) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment