korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-01 08:04:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

staging: wlan-ng: properly check endpoint types

Browse Source 
As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type

Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rustam Kovhaev 2020-07-22 09:10:52 -07:00 committed by Greg Kroah-Hartman
parent 926234f1b8
commit faaff97656
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/staging/wlan-ng/prism2usb.c
View File

@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
const struct usb_device_id *id)
{
struct usb_device *dev;
const struct usb_endpoint_descriptor *epd;
const struct usb_host_interface *iface_desc = interface->cur_altsetting;
struct wlandevice *wlandev = NULL;
struct hfa384x *hw = NULL;
int result = 0;
if (iface_desc->desc.bNumEndpoints != 2) {
result = -ENODEV;
goto failed;
}
result = -EINVAL;
epd = &iface_desc->endpoint[1].desc;
if (!usb_endpoint_is_bulk_in(epd))
goto failed;
epd = &iface_desc->endpoint[2].desc;
if (!usb_endpoint_is_bulk_out(epd))
goto failed;
dev = interface_to_usbdev(interface);
wlandev = create_wlan();
if (!wlandev) {