linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Arend van Spriel <arend@broadcom.com>,
	Johan Hovold <johan@kernel.org>,
	Kalle Valo <kvalo@codeaurora.org>
Subject: [PATCH 4.19 20/55] brcmfmac: fix interface sanity check
Date: Thu, 30 Jan 2020 19:39:01 +0100	[thread overview]
Message-ID: <20200130183612.476659754@linuxfoundation.org> (raw)
In-Reply-To: <20200130183608.563083888@linuxfoundation.org>

From: Johan Hovold <johan@kernel.org>

commit 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Cc: stable <stable@vger.kernel.org>     # 3.4
Cc: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1357,7 +1357,7 @@ brcmf_usb_probe(struct usb_interface *in
 		goto fail;
 	}
 
-	desc = &intf->altsetting[0].desc;
+	desc = &intf->cur_altsetting->desc;
 	if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
 	    (desc->bInterfaceSubClass != 2) ||
 	    (desc->bInterfaceProtocol != 0xff)) {
@@ -1370,7 +1370,7 @@ brcmf_usb_probe(struct usb_interface *in
 
 	num_of_eps = desc->bNumEndpoints;
 	for (ep = 0; ep < num_of_eps; ep++) {
-		endpoint = &intf->altsetting[0].endpoint[ep].desc;
+		endpoint = &intf->cur_altsetting->endpoint[ep].desc;
 		endpoint_num = usb_endpoint_num(endpoint);
 		if (!usb_endpoint_xfer_bulk(endpoint))
 			continue;



  parent reply	other threads:[~2020-01-30 18:47 UTC|newest]

Thread overview: 66+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-30 18:38 [PATCH 4.19 00/55] 4.19.101-stable review Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 01/55] orinoco_usb: fix interface sanity check Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 02/55] rsi_91x_usb: " Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 03/55] usb: dwc3: pci: add ID for the Intel Comet Lake -V variant Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 04/55] USB: serial: ir-usb: add missing endpoint sanity check Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 05/55] USB: serial: ir-usb: fix link-speed handling Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 06/55] USB: serial: ir-usb: fix IrLAP framing Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 07/55] usb: dwc3: turn off VBUS when leaving host mode Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 08/55] staging: most: net: fix buffer overflow Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 09/55] staging: wlan-ng: ensure error return is actually returned Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 10/55] staging: vt6656: correct packet types for CTS protect, mode Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 11/55] staging: vt6656: use NULLFUCTION stack on mac80211 Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 12/55] staging: vt6656: Fix false Tx excessive retries reporting Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 13/55] serial: 8250_bcm2835aux: Fix line mismatch on driver unbind Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 14/55] component: do not dereference opaque pointer in debugfs Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 15/55] mei: me: add comet point (lake) H device ids Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 16/55] iio: st_gyro: Correct data for LSM9DS0 gyro Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 17/55] crypto: chelsio - fix writing tfm flags to wrong place Greg Kroah-Hartman
2020-01-30 18:38 ` [PATCH 4.19 18/55] cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 19/55] ath9k: fix storage endpoint lookup Greg Kroah-Hartman
2020-01-30 18:39 ` Greg Kroah-Hartman [this message]
2020-01-30 18:39 ` [PATCH 4.19 21/55] rtl8xxxu: fix interface sanity check Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 22/55] zd1211rw: fix storage endpoint lookup Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 23/55] net_sched: ematch: reject invalid TCF_EM_SIMPLE Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 24/55] net_sched: fix ops->bind_class() implementations Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 25/55] HID: multitouch: Add LG MELF0410 I2C touchscreen support Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 26/55] arc: eznps: fix allmodconfig kconfig warning Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 27/55] HID: Add quirk for Xin-Mo Dual Controller Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 28/55] HID: ite: Add USB id match for Acer SW5-012 keyboard dock Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 29/55] HID: Add quirk for incorrect input length on Lenovo Y720 Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 30/55] drivers/hid/hid-multitouch.c: fix a possible null pointer access Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 31/55] phy: qcom-qmp: Increase PHY ready timeout Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 32/55] phy: cpcap-usb: Prevent USB line glitches from waking up modem Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 33/55] watchdog: max77620_wdt: fix potential build errors Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 34/55] watchdog: rn5t618_wdt: fix module aliases Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 35/55] spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 36/55] drivers/net/b44: Change to non-atomic bit operations on pwol_mask Greg Kroah-Hartman
2020-01-31 12:57   ` Pavel Machek
2020-01-31 13:45     ` David Laight
2020-01-31 14:03     ` Peter Zijlstra
2020-01-31 21:44     ` Luck, Tony
2020-01-30 18:39 ` [PATCH 4.19 37/55] net: wan: sdla: Fix cast from pointer to integer of different size Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 38/55] gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 39/55] atm: eni: fix uninitialized variable warning Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 40/55] HID: steam: Fix input device disappearing Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 41/55] platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 42/55] PCI: Add DMA alias quirk for Intel VCA NTB Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 43/55] iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 44/55] ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 45/55] usb-storage: Disable UAS on JMicron SATA enclosure Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 46/55] sched/fair: Add tmp_alone_branch assertion Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 47/55] sched/fair: Fix insertion in rq->leaf_cfs_rq_list Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 48/55] rsi: fix use-after-free on probe errors Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 49/55] rsi: fix memory leak on failed URB submission Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 50/55] rsi: fix non-atomic allocation in completion handler Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 51/55] crypto: af_alg - Use bh_lock_sock in sk_destruct Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 52/55] random: try to actively add entropy rather than passively wait for it Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 53/55] block: cleanup __blkdev_issue_discard() Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 54/55] block: fix 32 bit overflow in __blkdev_issue_discard() Greg Kroah-Hartman
2020-01-30 18:39 ` [PATCH 4.19 55/55] KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE Greg Kroah-Hartman
2020-01-31  4:40 ` [PATCH 4.19 00/55] 4.19.101-stable review shuah
2020-01-31 11:03 ` Jon Hunter
2020-01-31 13:12 ` Pavel Machek
2020-01-31 21:30   ` Greg Kroah-Hartman
2020-01-31 14:40 ` Naresh Kamboju
2020-01-31 17:32 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200130183612.476659754@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=arend@broadcom.com \
    --cc=johan@kernel.org \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).