From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Bjørn Mork" <bjorn@mork.no>,
syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com,
"Jakub Kicinski" <jakub.kicinski@netronome.com>,
"Sasha Levin" <sashal@kernel.org>,
linux-usb@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.2 24/63] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
Date: Tue, 1 Oct 2019 12:40:46 -0400 [thread overview]
Message-ID: <20191001164125.15398-24-sashal@kernel.org> (raw)
In-Reply-To: <20191001164125.15398-1-sashal@kernel.org>
From: Bjørn Mork <bjorn@mork.no>
[ Upstream commit 3fe4b3351301660653a2bc73f2226da0ebd2b95e ]
Endpoints with zero wMaxPacketSize are not usable for transferring
data. Ignore such endpoints when looking for valid in, out and
status pipes, to make the driver more robust against invalid and
meaningless descriptors.
The wMaxPacketSize of the out pipe is used as divisor. So this change
fixes a divide-by-zero bug.
Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/cdc_ncm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 50c05d0f44cb3..00cab3f43a4ca 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -681,8 +681,12 @@ cdc_ncm_find_endpoints(struct usbnet *dev, struct usb_interface *intf)
u8 ep;
for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) {
-
e = intf->cur_altsetting->endpoint + ep;
+
+ /* ignore endpoints which cannot transfer data */
+ if (!usb_endpoint_maxp(&e->desc))
+ continue;
+
switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
case USB_ENDPOINT_XFER_INT:
if (usb_endpoint_dir_in(&e->desc)) {
--
2.20.1
next prev parent reply other threads:[~2019-10-01 16:57 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-01 16:40 [PATCH AUTOSEL 5.2 01/63] drivers: thermal: qcom: tsens: Fix memory leak from qfprom read Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 02/63] ima: always return negative code for error Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 03/63] ima: fix freeing ongoing ahash_request Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 04/63] fs: nfs: Fix possible null-pointer dereferences in encode_attrs() Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 05/63] xprtrdma: Send Queue size grows after a reconnect Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 06/63] 9p: Transport error uninitialized Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 07/63] 9p: avoid attaching writeback_fid on mmap with type PRIVATE Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 08/63] 9p/cache.c: Fix memory leak in v9fs_cache_session_get_cookie Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 09/63] xen/pci: reserve MCFG areas earlier Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 10/63] fuse: fix request limit Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 11/63] ceph: fix directories inode i_blkbits initialization Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 12/63] ceph: fetch cap_gen under spinlock in ceph_add_cap Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 13/63] ceph: reconnect connection if session hang in opening state Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 14/63] rbd: fix response length parameter for encoded strings Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 15/63] SUNRPC: RPC level errors should always set task->tk_rpc_status Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 16/63] watchdog: aspeed: Add support for AST2600 Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 17/63] netfilter: nf_tables: allow lookups in dynamic sets Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 18/63] drm/amdgpu: Fix KFD-related kernel oops on Hawaii Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 19/63] drm/amdgpu: Check for valid number of registers to read Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 20/63] pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 21/63] SUNRPC: Don't try to parse incomplete RPC messages Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 22/63] net/sched: act_sample: don't push mac header on ip6gre ingress Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 23/63] pwm: stm32-lp: Add check in case requested period cannot be achieved Sasha Levin
2019-10-01 16:40 ` Sasha Levin [this message]
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 25/63] usbnet: ignore endpoints with invalid wMaxPacketSize Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 26/63] net/phy: fix DP83865 10 Mbps HDX loopback disable function Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 27/63] net_sched: add max len check for TCA_KIND Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 28/63] x86/purgatory: Disable the stackleak GCC plugin for the purgatory Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 29/63] ntb: point to right memory window index Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 30/63] thermal: Fix use-after-free when unregistering thermal zone device Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 31/63] thermal_hwmon: Sanitize thermal_zone type Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 32/63] iommu/amd: Fix downgrading default page-sizes in alloc_pte() Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 33/63] libnvdimm/region: Initialize bad block for volatile namespaces Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 34/63] net/mlx5e: Fix traffic duplication in ethtool steering Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 35/63] KVM: hyperv: Fix Direct Synthetic timers assert an interrupt w/o lapic_in_kernel Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 36/63] libnvdimm: Fix endian conversion issues Sasha Levin
2019-10-01 16:40 ` [PATCH AUTOSEL 5.2 37/63] fuse: fix memleak in cuse_channel_open Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 38/63] arcnet: provide a buffer big enough to actually receive packets Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 39/63] libnvdimm/nfit_test: Fix acpi_handle redefinition Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 40/63] ppp: Fix memory leak in ppp_write Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 41/63] sched/membarrier: Call sync_core only before usermode for same mm Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 42/63] sched/membarrier: Fix private expedited registration check Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 43/63] sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 44/63] perf build: Add detection of java-11-openjdk-devel package Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 45/63] include/trace/events/writeback.h: fix -Wstringop-truncation warnings Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 46/63] kernel/elfcore.c: include proper prototypes Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 47/63] kexec: bail out upon SIGKILL when allocating memory Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 48/63] blk-mq: move lockdep_assert_held() into elevator_exit Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 49/63] bpf: Fix bpf_event_output re-entry issue Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 50/63] macsec: drop skb sk before calling gro_cells_receive Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 51/63] i2c: qcom-geni: Disable DMA processing on the Lenovo Yoga C630 Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 52/63] perf unwind: Fix libunwind build failure on i386 systems Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 53/63] nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 54/63] net: phy: micrel: add Asym Pause workaround for KSZ9021 Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 55/63] mlxsw: spectrum_flower: Fail in case user specifies multiple mirror actions Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 56/63] vrf: Do not attempt to create IPv6 mcast rule if IPv6 is disabled Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 57/63] nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 58/63] nfp: abm: fix memory leak in nfp_abm_u32_knode_replace Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 59/63] fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 60/63] drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 61/63] usbnet: sanity checking of packet sizes and device mtu Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 62/63] sch_netem: fix a divide by zero in tabledist() Sasha Levin
2019-10-01 16:41 ` [PATCH AUTOSEL 5.2 63/63] Btrfs: fix selftests failure due to uninitialized i_mode in test inodes Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191001164125.15398-24-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bjorn@mork.no \
--cc=jakub.kicinski@netronome.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).