From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Fedor Pchelkin" <pchelkin@ispras.ru>,
"Alan Stern" <stern@rowland.harvard.edu>,
"Alexey Khoroshilov" <khoroshilov@ispras.ru>,
"Toke Høiland-Jørgensen" <toke@toke.dk>,
"Kalle Valo" <quic_kvalo@quicinc.com>,
"Sasha Levin" <sashal@kernel.org>,
kvalo@kernel.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 04/85] wifi: ath9k: verify the expected usb_endpoints are present
Date: Sun, 18 Dec 2022 11:00:21 -0500 [thread overview]
Message-ID: <20221218160142.925394-4-sashal@kernel.org> (raw)
In-Reply-To: <20221218160142.925394-1-sashal@kernel.org>
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 16ef02bad239f11f322df8425d302be62f0443ce ]
The bug arises when a USB device claims to be an ATH9K but doesn't
have the expected endpoints. (In this case there was an interrupt
endpoint where the driver expected a bulk endpoint.) The kernel
needs to be able to handle such devices without getting an internal error.
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493
Modules linked in:
CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: events request_firmware_work_func
RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493
Call Trace:
ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline]
ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019
ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline]
ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242
request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097
process_one_work+0x9af/0x1600 kernel/workqueue.c:2279
worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425
kthread+0x3b4/0x4a0 kernel/kthread.c:313
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20221008211532.74583-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 4d9002a9d082..1ffd6cd5dceb 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1329,10 +1329,24 @@ static int send_eject_command(struct usb_interface *interface)
static int ath9k_hif_usb_probe(struct usb_interface *interface,
const struct usb_device_id *id)
{
+ struct usb_endpoint_descriptor *bulk_in, *bulk_out, *int_in, *int_out;
struct usb_device *udev = interface_to_usbdev(interface);
+ struct usb_host_interface *alt;
struct hif_device_usb *hif_dev;
int ret = 0;
+ /* Verify the expected endpoints are present */
+ alt = interface->cur_altsetting;
+ if (usb_find_common_endpoints(alt, &bulk_in, &bulk_out, &int_in, &int_out) < 0 ||
+ usb_endpoint_num(bulk_in) != USB_WLAN_RX_PIPE ||
+ usb_endpoint_num(bulk_out) != USB_WLAN_TX_PIPE ||
+ usb_endpoint_num(int_in) != USB_REG_IN_PIPE ||
+ usb_endpoint_num(int_out) != USB_REG_OUT_PIPE) {
+ dev_err(&udev->dev,
+ "ath9k_htc: Device endpoint numbers are not the expected ones\n");
+ return -ENODEV;
+ }
+
if (id->driver_info == STORAGE_DEVICE)
return send_eject_command(interface);
--
2.35.1
next prev parent reply other threads:[~2022-12-18 16:02 UTC|newest]
Thread overview: 86+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-18 16:00 [PATCH AUTOSEL 6.1 01/85] drm/etnaviv: add missing quirks for GC300 Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 02/85] media: imx-jpeg: Disable useless interrupt to avoid kernel panic Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 03/85] brcmfmac: return error when getting invalid max_flowrings from dongle Sasha Levin
2022-12-18 16:00 ` Sasha Levin [this message]
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 05/85] wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 06/85] ASoC: codecs: rt298: Add quirk for KBL-R RVP platform Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 07/85] ASoC: Intel: avs: " Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 08/85] ipmi: fix memleak when unload ipmi driver Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 09/85] wifi: ath10k: Delay the unmapping of the buffer Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 10/85] openvswitch: Use kmalloc_size_roundup() to match ksize() usage Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 11/85] bnx2: " Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 12/85] drm/amd/display: skip commit minimal transition state Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 13/85] drm/amd/display: prevent memory leak Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 14/85] drm/edid: add a quirk for two LG monitors to get them to work on 10bpc Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 15/85] Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 16/85] drm/rockchip: use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 17/85] blk-mq: avoid double ->queue_rq() because of early timeout Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 18/85] HID: apple: fix key translations where multiple quirks attempt to translate the same key Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 19/85] HID: apple: enable APPLE_ISO_TILDE_QUIRK for the keyboards of Macs with the T2 chip Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 20/85] wifi: ath11k: Fix qmi_msg_handler data structure initialization Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 21/85] qed (gcc13): use u16 for fid to be big enough Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 22/85] drm/meson: Fix return type of meson_encoder_cvbs_mode_valid() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 23/85] bpf: make sure skb->len != 0 when redirecting to a tunneling device Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 24/85] net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 25/85] hamradio: baycom_epp: Fix return type of baycom_send_packet() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 26/85] wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 27/85] wifi: brcmfmac: Fix potential NULL pointer dereference in 'brcmf_c_preinit_dcmds()' Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 28/85] HID: input: do not query XP-PEN Deco LW battery Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 29/85] HID: uclogic: Add support for XP-PEN Deco LW Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 30/85] igb: Do not free q_vector unless new one was allocated Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 31/85] drm/amdgpu: Fix type of second parameter in trans_msg() callback Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 32/85] drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 33/85] s390/ctcm: Fix return type of ctc{mp,}m_tx() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 34/85] s390/netiucv: Fix return type of netiucv_tx() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 35/85] s390/lcs: Fix return type of lcs_start_xmit() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 36/85] drm/amd/display: Use min transition for SubVP into MPO Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 37/85] drm/amd/display: Disable DRR actions during state commit Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 38/85] drm/msm: Use drm_mode_copy() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 39/85] drm/rockchip: " Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 40/85] drm/sti: " Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 41/85] drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() Sasha Levin
2022-12-18 16:00 ` [PATCH AUTOSEL 6.1 42/85] drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 43/85] md/raid0, raid10: Don't set discard sectors for request queue Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 44/85] md/raid1: stop mdx_raid1 thread when raid1 array run failed Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 45/85] drm/amd/display: Workaround to increase phantom pipe vactive in pipesplit Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 46/85] drm/amd/display: fix array index out of bound error in bios parser Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 47/85] nvme-auth: don't override ctrl keys before validation Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 48/85] net: add atomic_long_t to net_device_stats fields Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 49/85] ipv6/sit: use DEV_STATS_INC() to avoid data-races Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 50/85] mrp: introduce active flags to prevent UAF when applicant uninit Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 51/85] net: ethernet: mtk_eth_soc: drop packets to WDMA if the ring is full Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 52/85] bpf/verifier: Use kmalloc_size_roundup() to match ksize() usage Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 53/85] ppp: associate skb with a device at tx Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 54/85] drm/amd/display: Fix display corruption w/ VSR enable Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 55/85] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 56/85] bpf: Prevent decl_tag from being referenced in func_proto arg Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 57/85] ethtool: avoiding integer overflow in ethtool_phys_id() Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 58/85] media: dvb-frontends: fix leak of memory fw Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 59/85] media: dvbdev: adopts refcnt to avoid UAF Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 60/85] media: dvb-usb: fix memory leak in dvb_usb_adapter_init() Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 61/85] media: mediatek: vcodec: Can't set dst buffer to done when lat decode error Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 62/85] blk-mq: fix possible memleak when register 'hctx' failed Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 63/85] ALSA: usb-audio: Add quirk for Tascam Model 12 Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 64/85] drm/amdgpu: Fix potential double free and null pointer dereference Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 65/85] drm/amd/display: Use the largest vready_offset in pipe group Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 66/85] drm/amd/display: Fix DTBCLK disable requests and SRC_SEL programming Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 67/85] ASoC: amd: yc: Add Xiaomi Redmi Book Pro 14 2022 into DMI table Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 68/85] libbpf: Avoid enum forward-declarations in public API in C++ mode Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 69/85] regulator: core: fix use_count leakage when handling boot-on Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 70/85] net: dpaa2: publish MAC stringset to ethtool -S even if MAC is missing Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 71/85] wifi: mt76: do not run mt76u_status_worker if the device is not running Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 72/85] hwmon: (nct6775) add ASUS CROSSHAIR VIII/TUF/ProArt B550M Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 73/85] selftests/bpf: Fix conflicts with built-in functions in bpf_iter_ksym Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 74/85] nfs: fix possible null-ptr-deref when parsing param Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 75/85] mmc: f-sdh30: Add quirks for broken timeout clock capability Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 76/85] mmc: renesas_sdhi: add quirk for broken register layout Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 77/85] mmc: renesas_sdhi: better reset from HS400 mode Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 78/85] mmc: sdhci-tegra: Issue CMD and DAT resets together Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 79/85] media: si470x: Fix use-after-free in si470x_int_in_callback() Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 80/85] clk: st: Fix memory leak in st_of_quadfs_setup() Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 81/85] regulator: core: Use different devices for resource allocation and DT lookup Sasha Levin
2022-12-19 1:08 ` ChiYuan Huang
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 82/85] ice: synchronize the misc IRQ when tearing down Tx tracker Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 83/85] Bluetooth: hci_bcm: Add CYW4373A0 support Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 84/85] Bluetooth: Add quirk to disable extended scanning Sasha Levin
2022-12-18 16:01 ` [PATCH AUTOSEL 6.1 85/85] Bluetooth: Add quirk to disable MWS Transport Configuration Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221218160142.925394-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=khoroshilov@ispras.ru \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pchelkin@ispras.ru \
--cc=quic_kvalo@quicinc.com \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=toke@toke.dk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).