* [PATCH] Bluetooth: fix division by zero in send path
@ 2021-10-25 11:39 Johan Hovold
2021-10-25 13:05 ` Marcel Holtmann
0 siblings, 1 reply; 2+ messages in thread
From: Johan Hovold @ 2021-10-25 11:39 UTC (permalink / raw)
To: Marcel Holtmann
Cc: Johan Hedberg, Luiz Augusto von Dentz, linux-bluetooth,
linux-usb, linux-kernel, Johan Hovold, stable
Add the missing bulk-out endpoint sanity check to probe() to avoid
division by zero in bfusb_send_frame() in case a malicious device has
broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/bluetooth/bfusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 5a321b4076aa..df80fb324356 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -627,6 +627,8 @@ static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *i
data->bulk_in_ep = bulk_in_ep->desc.bEndpointAddress;
data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress;
data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize);
+ if (!data->bulk_pkt_size)
+ goto done;
rwlock_init(&data->lock);
--
2.32.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Bluetooth: fix division by zero in send path
2021-10-25 11:39 [PATCH] Bluetooth: fix division by zero in send path Johan Hovold
@ 2021-10-25 13:05 ` Marcel Holtmann
0 siblings, 0 replies; 2+ messages in thread
From: Marcel Holtmann @ 2021-10-25 13:05 UTC (permalink / raw)
To: Johan Hovold
Cc: Johan Hedberg, Luiz Augusto von Dentz, linux-bluetooth,
linux-usb, linux-kernel, stable
Hi Johan,
> Add the missing bulk-out endpoint sanity check to probe() to avoid
> division by zero in bfusb_send_frame() in case a malicious device has
> broken descriptors (or when doing descriptor fuzz testing).
>
> Note that USB core will reject URBs submitted for endpoints with zero
> wMaxPacketSize but that drivers doing packet-size calculations still
> need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
> endpoint descriptors with maxpacket=0")).
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
> drivers/bluetooth/bfusb.c | 2 ++
> 1 file changed, 2 insertions(+)
patch has been applied to bluetooth-next tree.
Regards
Marcel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-10-25 13:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-25 11:39 [PATCH] Bluetooth: fix division by zero in send path Johan Hovold
2021-10-25 13:05 ` Marcel Holtmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.