linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Bjørn Mork" <bjorn@mork.no>,
	"Jakub Kicinski" <jakub.kicinski@netronome.com>,
	"Sasha Levin" <sashal@kernel.org>,
	netdev@vger.kernel.org, linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 19/43] usbnet: ignore endpoints with invalid wMaxPacketSize
Date: Tue,  1 Oct 2019 12:42:47 -0400	[thread overview]
Message-ID: <20191001164311.15993-19-sashal@kernel.org> (raw)
In-Reply-To: <20191001164311.15993-1-sashal@kernel.org>

From: Bjørn Mork <bjorn@mork.no>

[ Upstream commit 8d3d7c2029c1b360f1a6b0a2fca470b57eb575c0 ]

Endpoints with zero wMaxPacketSize are not usable for transferring
data. Ignore such endpoints when looking for valid in, out and
status pipes, to make the drivers more robust against invalid and
meaningless descriptors.

The wMaxPacketSize of these endpoints are used for memory allocations
and as divisors in many usbnet minidrivers. Avoiding zero is therefore
critical.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/usbnet.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 10854977c55f1..52ffb2360cc90 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -112,6 +112,11 @@ int usbnet_get_endpoints(struct usbnet *dev, struct usb_interface *intf)
 			int				intr = 0;
 
 			e = alt->endpoint + ep;
+
+			/* ignore endpoints which cannot transfer data */
+			if (!usb_endpoint_maxp(&e->desc))
+				continue;
+
 			switch (e->desc.bmAttributes) {
 			case USB_ENDPOINT_XFER_INT:
 				if (!usb_endpoint_dir_in(&e->desc))
-- 
2.20.1


  parent reply	other threads:[~2019-10-01 16:52 UTC|newest]

Thread overview: 43+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-01 16:42 [PATCH AUTOSEL 4.19 01/43] ima: always return negative code for error Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 02/43] ima: fix freeing ongoing ahash_request Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 03/43] fs: nfs: Fix possible null-pointer dereferences in encode_attrs() Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 04/43] 9p: Transport error uninitialized Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 05/43] 9p: avoid attaching writeback_fid on mmap with type PRIVATE Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 06/43] 9p/cache.c: Fix memory leak in v9fs_cache_session_get_cookie Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 07/43] xen/pci: reserve MCFG areas earlier Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 08/43] ceph: fix directories inode i_blkbits initialization Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 09/43] ceph: reconnect connection if session hang in opening state Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 10/43] rbd: fix response length parameter for encoded strings Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 11/43] watchdog: aspeed: Add support for AST2600 Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 12/43] netfilter: nf_tables: allow lookups in dynamic sets Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 13/43] drm/amdgpu: Fix KFD-related kernel oops on Hawaii Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 14/43] drm/amdgpu: Check for valid number of registers to read Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 15/43] pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 16/43] net/sched: act_sample: don't push mac header on ip6gre ingress Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 17/43] pwm: stm32-lp: Add check in case requested period cannot be achieved Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 18/43] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Sasha Levin
2019-10-01 16:42 ` Sasha Levin [this message]
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 20/43] net/phy: fix DP83865 10 Mbps HDX loopback disable function Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 21/43] net_sched: add max len check for TCA_KIND Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 22/43] x86/purgatory: Disable the stackleak GCC plugin for the purgatory Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 23/43] ntb: point to right memory window index Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 24/43] thermal: Fix use-after-free when unregistering thermal zone device Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 25/43] thermal_hwmon: Sanitize thermal_zone type Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 26/43] libnvdimm/region: Initialize bad block for volatile namespaces Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 27/43] fuse: fix memleak in cuse_channel_open Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 28/43] arcnet: provide a buffer big enough to actually receive packets Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 29/43] libnvdimm/nfit_test: Fix acpi_handle redefinition Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 30/43] ppp: Fix memory leak in ppp_write Sasha Levin
2019-10-01 16:42 ` [PATCH AUTOSEL 4.19 31/43] sched/membarrier: Call sync_core only before usermode for same mm Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 32/43] sched/membarrier: Fix private expedited registration check Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 33/43] sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 34/43] perf build: Add detection of java-11-openjdk-devel package Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 35/43] kernel/elfcore.c: include proper prototypes Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 36/43] kexec: bail out upon SIGKILL when allocating memory Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 37/43] macsec: drop skb sk before calling gro_cells_receive Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 38/43] perf unwind: Fix libunwind build failure on i386 systems Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 39/43] nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 40/43] nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 41/43] drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 42/43] usbnet: sanity checking of packet sizes and device mtu Sasha Levin
2019-10-01 16:43 ` [PATCH AUTOSEL 4.19 43/43] sch_netem: fix a divide by zero in tabledist() Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191001164311.15993-19-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=bjorn@mork.no \
    --cc=jakub.kicinski@netronome.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).