From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F59BC433DF for ; Fri, 9 Oct 2020 16:20:46 +0000 (UTC) Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 781472225D for ; Fri, 9 Oct 2020 16:20:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="H8vtangY" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 781472225D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-kernel-mentees-bounces@lists.linuxfoundation.org Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id E3D51877DC; Fri, 9 Oct 2020 16:20:44 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hxWvBOG4KR1q; Fri, 9 Oct 2020 16:20:44 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by whitealder.osuosl.org (Postfix) with ESMTP id 605BE8775D; Fri, 9 Oct 2020 16:20:44 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 495B1C016F; Fri, 9 Oct 2020 16:20:44 +0000 (UTC) Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists.linuxfoundation.org (Postfix) with ESMTP id 02373C0051 for ; Fri, 9 Oct 2020 16:20:42 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id D5F092E2A9 for ; Fri, 9 Oct 2020 16:20:42 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PIAM2drekKEG for ; Fri, 9 Oct 2020 16:20:41 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by silver.osuosl.org (Postfix) with ESMTPS id 1FAC12E298 for ; Fri, 9 Oct 2020 16:20:41 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id n9so7554283pgf.9 for ; Fri, 09 Oct 2020 09:20:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=mP+aJbUAat0UV4esY+1JsE6q/zZ+Jt33VyknqBiKg6E=; b=H8vtangYCZZ+rQo2KOQ7hhPSTvZztsIedGeLPsRZ1uamjVukb7XGoPTUeMIx+FIzRu b6vFDbHC4nyU2AsQjT8sNUGWq2ZCcmSjFp3vw+lgMY5ATWNuQNZdAK2H/hjU8O3V9CtT HallgOMsilAG0KHTairyYihZzET/881krznSKPcC/cjm0uz+ng1KI+JTtuj7oSJxuj/J VzmK/OlUs+oT4QptXSWDbMgHNk0OIGU7ojpB9m7mwm31BM+AjreQhCPGeWr7sNZAzubO wWfm3H2Ph4/Gno9/d/WoPQYybFh74inmjJDTI76qXPo42YHTlAuP7iv7pACAIj63B9Ds CJvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=mP+aJbUAat0UV4esY+1JsE6q/zZ+Jt33VyknqBiKg6E=; b=X1FlgTQjqBkkvWXMYA8qN0+iMLTJv3SnKqf4sonpCVpdmeaLM3RMwS7JRC03hdHFsF VJHGRO9whhb8Vv3KQMMY/7QcUOkDgPL4j9vVB/K8RnD2uKT9t60UlhkeaIGg99Hp4pFu dlBGGdGOoI+J8Zq4j9Bn5qElfm3hA9/sSHLG+MXds4HUm/sI1aE2c6covtNMO5/EjhwB XTO0q1WVPi2mci3TNJHwUuFkyH0F8PQ8Qlgr9vszFkvfwGD+Op7VGVncoWDtYNEVkq6X i6BxwI806fF6ImC7GgBfo79pzwbPq11twPQVAqyVYTwhIPsCKgHzK+cnlN96YxxWTHl2 DF3g== X-Gm-Message-State: AOAM53318AXb7Pz0ghaECoFyV9u5BGpA7kT+KtxY8TrcS72tCB4dGAMN /AV+CpZ/ZMnmn7x7j/gsYCGYlhrX14e1etG7Xe4= X-Google-Smtp-Source: ABdhPJyARPOvuTSwMuRPOKozcnKxADEWGnflnK+0e+Bke7F1X7H6ejWfNx6wuvsaN93e4Q1NYAr2Lw== X-Received: by 2002:a17:90a:1861:: with SMTP id r88mr5337711pja.222.1602260439006; Fri, 09 Oct 2020 09:20:39 -0700 (PDT) Received: from localhost.localdomain ([49.207.205.113]) by smtp.gmail.com with ESMTPSA id h31sm11163325pgh.71.2020.10.09.09.20.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Oct 2020 09:20:38 -0700 (PDT) From: Anant Thazhemadam To: Date: Fri, 9 Oct 2020 21:50:29 +0530 Message-Id: <20201009162030.293781-1-anant.thazhemadam@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Cc: devel@driverdev.osuosl.org, Anant Thazhemadam , linux-kernel@vger.kernel.org, H Hartley Sweeten , Ian Abbott , syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com, linux-kernel-mentees@lists.linuxfoundation.org Subject: [Linux-kernel-mentees] [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found X-BeenThere: linux-kernel-mentees@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: linux-kernel-mentees-bounces@lists.linuxfoundation.org Sender: "Linux-kernel-mentees" While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if wMaxPacketSize = 0 for the endpoints found. Some devices have isochronous endpoints that have wMaxPacketSize = 0 (as required by the USB-2 spec). However, since this doesn't apply here, wMaxPacketSize = 0 can be considered to be invalid. Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam --- The error (as detected by syzbot) is generated in vmk80xx_write_packet() (which is called in vmk80xx_reset_device()) when it tries to assign devpriv->usb_tx_buf[0] = cmd. This NULL pointer dereference issue arises because size = usb_endpoint_maxp(devpriv->ep_tx) = 0. This can be traced back to vmk80xx_find_usb_endpoints(), where the usb endpoints are found, and assigned accordingly. (For some more insight, in vmk80xx_find_usb_endpoints(), if one of intf->cur_altsetting->iface_desc->endpoints' desc value = 0, and consequently this endpoint is assigned to devpriv->ep_tx, this issue gets triggered.) Checking if the wMaxPacketSize of an endpoint is invalid and returning an error value accordingly, seems to fix the error. We could also alternatively perform this checking (if the size is 0 or not) in vmk80xx_reset_device() itself, but it only seemed like covering up the issue at that place, rather than fixing it, so I wasn't sure that was any better. However, if I'm not wrong, this might end up causing the probe to fail, and I'm not sure if that's the right thing to do in cases like this, and if it isn't I'd like some input on what exactly is the required course of action in cases like this. drivers/staging/comedi/drivers/vmk80xx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c index 65dc6c51037e..cb0a965d3c37 100644 --- a/drivers/staging/comedi/drivers/vmk80xx.c +++ b/drivers/staging/comedi/drivers/vmk80xx.c @@ -667,6 +667,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) if (!devpriv->ep_rx || !devpriv->ep_tx) return -ENODEV; + if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx)) + return -EINVAL; + return 0; } -- 2.25.1 _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees